@kaydash9999/banker-plugins 0.24.1 → 0.25.0

package/skills/git-init/scripts/git-init.mjs

@@ -24,13 +24,17 @@
  * repository, a .git below the root, no commit identity). No network is used.
  */
 import { spawnSync } from "node:child_process";
-import { lstatSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { join, parse, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
 import { HASH, commitBlock, findBlock, markers, planBlock } from "./marker-block.mjs";
 import { scan } from "./payload-scan.mjs";
 
+// The folder programs start in: the home folder (Windows looks for a program in the working folder first, so a
+// program planted in the folder worked on never runs), or the temp folder when there is no home folder.
+const runDir = () => (existsSync(homedir()) ? homedir() : tmpdir());
+
 const USAGE = [
   "git-init: 민감 정보를 빼는 .gitignore 를 쓰고 비밀값을 스캔한 뒤 git init, git add ., git commit -m \"init\" 으로 첫 커밋을 만듦(check 는 계획만)",
   "사용법: node git-init.mjs [check|run] [--root <dir>] [--branch <이름>] [--local-identity \"<이름> <<메일>>\"] [--nested]",
@@ -120,9 +124,29 @@ function gitEnv(extra) {
   return env;
 }
 
-// Runs git; never throws. ok is false when git could not start or exited non-zero.
+// On Windows git is a wrapper (cmd\git.exe) that starts the real git: a time limit on the wrapper alone leaves the real
+// git running, which can still make the commit after the failure was reported. With a time limit, git runs under this
+// small Node supervisor instead, which ends the whole tree with System32's taskkill /T /F and exits 124.
+const TREE_SUPERVISOR = [
+  "const {spawn,spawnSync}=require('child_process');const p=require('path');",
+  "const [ms,...a]=process.argv.slice(1);",
+  "const c=spawn('git',a,{stdio:'inherit',windowsHide:true});",
+  "const t=setTimeout(()=>{spawnSync(p.win32.join(process.env.SystemRoot||'C:\\\\Windows','System32','taskkill.exe'),['/T','/F','/PID',String(c.pid)],{stdio:'ignore',windowsHide:true});process.exit(124)},Number(ms));",
+  "c.on('error',()=>process.exit(127));c.on('exit',(code)=>{clearTimeout(t);process.exit(code==null?1:code)});",
+].join("");
+
+// Runs git on the folder cwd (git -C), started from the home folder: Windows looks for a program in the working folder
+// first, so a git.exe inside the folder being initialized never runs. Never throws. ok is false when git could not
+// start or exited non-zero; a time-out is error.code ETIMEDOUT.
 function git(args, cwd, { env, timeout } = {}) {
-  const r = spawnSync("git", args, { cwd, encoding: "utf8", env: gitEnv(env), timeout, killSignal: "SIGKILL", maxBuffer: 256 * 1024 * 1024, windowsHide: true });
+  const opts = { cwd: runDir(), encoding: "utf8", env: gitEnv(env), killSignal: "SIGKILL", maxBuffer: 256 * 1024 * 1024, windowsHide: true };
+  const argv = ["-C", cwd, ...args];
+  if (timeout && process.platform === "win32") {
+    const r = spawnSync(process.execPath, ["-e", TREE_SUPERVISOR, String(timeout), ...argv], { ...opts, timeout: timeout + 30000 });
+    const error = r.status === 124 ? Object.assign(new Error("git timed out"), { code: "ETIMEDOUT" }) : r.error;
+    return { ok: !error && r.status === 0, out: r.stdout ?? "", err: (r.stderr ?? "").trim(), error };
+  }
+  const r = spawnSync("git", argv, { ...opts, timeout });
   return { ok: !r.error && r.status === 0, out: r.stdout ?? "", err: (r.stderr ?? "").trim(), error: r.error };
 }
 
@@ -136,12 +160,35 @@ const real = (p) => {
   }
 };
 
+// Whether a and b are one folder: device and inode (bigint, as NTFS file ids pass 2^53), or where the file system has
+// no inode numbers, the path as the file system spells it (realpathSync.native gives one spelling for names that differ
+// only in case, an 8.3 short name or a linked parent), case folded on Windows and macOS. A string compare of the JS
+// realpath let `--root c:\users\me` (or /users/me on macOS) pass the HOME refusal.
+function sameDir(a, b) {
+  try {
+    const x = statSync(a, { bigint: true });
+    const y = statSync(b, { bigint: true });
+    if (x.ino !== 0n && y.ino !== 0n) return x.dev === y.dev && x.ino === y.ino;
+  } catch {
+    // one is gone: the spellings below decide
+  }
+  const spell = (p) => {
+    try {
+      return realpathSync.native(p);
+    } catch {
+      return real(p);
+    }
+  };
+  const fold = (p) => (process.platform === "win32" || process.platform === "darwin" ? p.toLowerCase() : p);
+  return fold(spell(a)) === fold(spell(b));
+}
+
 // The root folder, or a failure: missing (2), HOME or a file system root (3).
 function checkRoot(rootArg) {
   const root = resolve(rootArg);
   if (!statSync(root, { throwIfNoEntry: false })?.isDirectory()) return fail(2, `루트 폴더가 없음: ${root}`);
   const r = real(root);
-  if (r === real(homedir())) return fail(3, `루트가 HOME 이라 거부: ${root}. 프로젝트 폴더에서 실행하거나 --root 로 지정`);
+  if (sameDir(root, homedir())) return fail(3, `루트가 HOME 이라 거부: ${root}. 프로젝트 폴더에서 실행하거나 --root 로 지정`);
   if (parse(r).root === r) return fail(3, `루트가 파일 시스템 루트라 거부: ${root}`);
   return { root };
 }
@@ -212,7 +259,7 @@ export function missingPatterns(text) {
 function gitignorePlan(root, follow) {
   const path = join(root, ".gitignore");
   const opts = { comment: HASH, id: ID, skill: SKILL, followSymlink: follow };
-  const probe = planBlock(path, { ...opts, body: null });
+  const probe = planBlock(path, { ...opts, body: null, readOnly: true }); // read only: never written
   if (!probe.ok) return { refuse: probe };
   const missing = missingPatterns(probe.before === null ? "" : probe.before.toString("utf8"));
   const plan = planBlock(path, { ...opts, body: missing.length > 0 ? [BLOCK_HEAD, ...missing].join("\n") : null });
@@ -325,6 +372,7 @@ function commitInit(root) {
 
 function runSteps(o, ctx) {
   const done = commitBlock(ctx.gi.plan, SKILL);
+  if (!done.ok) return fail(1, `.gitignore 거부: ${done.message}. git init 하지 않음`, { ...ctx.report, ok: false });
   const report = { ...ctx.report, gitignore: { ...ctx.report.gitignore, status: done.changed ? (done.created ? "created" : "updated") : "unchanged", backup: done.backup ?? null } };
   const list = listCandidates(ctx.tmp, ctx.root, []);
   const nested = list.filter((p) => p.endsWith("/"));

package/skills/git-init/scripts/marker-block.mjs

@@ -20,7 +20,7 @@
  *   file. Windows has no owner or permission bits to check.
  * - Writes go to a temp file in the same folder and a rename. A failed write removes the temp file.
  * - When the bytes change, the first original is kept in `<file>.<skill>.bak`; an existing backup is never
- *   overwritten.
+ *   overwritten. Something else at that name (a link, a folder) refuses the change (backup), so no original is lost.
  *
  * Results are { ok, changed, refused?, message, path, file }. Callers map refused to exit status 1.
  */
@@ -220,9 +220,25 @@ const options = (opts) => ({
   wrap: opts.wrap ?? null,
   skill: opts.skill,
   follow: opts.followSymlink === true,
+  readOnly: opts.readOnly === true, // a plan only read (never committed): no backup spot to check
   uid: "uid" in opts ? opts.uid : process.getuid?.(),
 });
 
+// A file not there yet is named by its folder as the file system spells it (one key for a linked parent, an 8.3 name
+// or the folder in another case) and its own name as given. Two names differing only in case still get two keys:
+// where the file system takes them for one file, applyBlocks meets that when the second create finds the first.
+const newFileKey = (file) => `path:${join(nativeReal(dirname(resolve(file))), basename(file))}`;
+
+// The key of a file that is there now, as planBlock gives it, or null when it cannot be read.
+function keyNow(file) {
+  try {
+    const id = statSync(file, { bigint: true });
+    return id.ino === 0n ? `path:${nativeReal(file)}` : `ino:${id.dev}:${id.ino}`;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Works out what applyBlock would write, without writing: { ok, changed, refused?, message, path, file, key,
  * before, after, mode }. key names the file (device and inode, or the path of a file not there yet).
@@ -234,13 +250,17 @@ export function planBlock(path, opts) {
   if (at.refuse) return at.refuse;
   if (!at.exists) {
     const after = o.body === null ? null : Buffer.from(blockText(o.mk, o.body, o.wrap, "\n"), "utf8");
-    return { ok: true, changed: after !== null, path, file: at.file, key: `path:${resolve(at.file)}`, before: null, after, mode: NEW_FILE_MODE };
+    return { ok: true, changed: after !== null, path, file: at.file, key: newFileKey(at.file), before: null, after, mode: NEW_FILE_MODE };
   }
   const read = readChecked(at.file, o.uid);
   if (read.refuse) return read.refuse;
   const next = nextBytes(read.bytes, o, at.file);
   if (next.refuse) return next.refuse;
   const changed = !next.bytes.equals(read.bytes);
+  // A change keeps the first original in <file>.<skill>.bak: something else there (a link, a folder) is refused now,
+  // in the plan, so a dry run, a status and a check say so before anything is written.
+  const bakWhy = changed && !o.readOnly ? backupSpotWhy(`${at.file}.${o.skill}.bak`) : null;
+  if (bakWhy) return refusal("backup", `${bakWhy}: ${at.file}.${o.skill}.bak`, path);
   // ino 0 (a file system without file ids) tells nothing apart: then the path as the file system spells it is the
   // key (realpathSync.native gives one spelling for names that differ only in case where case is ignored).
   const key = read.id.ino === 0n ? `path:${nativeReal(at.file)}` : `ino:${read.id.dev}:${read.id.ino}`;
@@ -264,36 +284,111 @@ function writeAtomic(file, data, mode) {
   }
 }
 
-// Keeps the first original: writes <file>.<skill>.bak only when nothing is at that name yet.
-function backup(file, skill, bytes) {
-  const bak = `${file}.${skill}.bak`;
-  if (lstatSync(bak, { throwIfNoEntry: false })) return null;
-  const fd = openSync(bak, "wx", BACKUP_MODE);
+// Opens a file not there yet, as "wx" does, and makes sure the name is the file made. Anything at the name, a link to
+// nothing among them, is EEXIST: Windows opens "wx" through a link to nothing and makes the file it leads to (macOS
+// and Linux answer EEXIST), so the name is looked at first, and a link planted between that look and the open is
+// caught after it by comparing the opened file with the name; the empty file made through it is taken back.
+function openFresh(path, mode) {
+  if (lstatSync(path, { throwIfNoEntry: false })) throw eexist(path);
+  const fd = openSync(path, "wx", mode);
+  let made;
+  let st;
+  try {
+    made = fstatSync(fd, { bigint: true });
+    st = lstatSync(path, { bigint: true, throwIfNoEntry: false });
+  } catch {
+    return fd; // cannot look (ESTALE, EPERM): the file is the caller's, as a plain "wx" leaves it
+  }
+  if (st && !st.isSymbolicLink() && (made.ino === 0n || (st.dev === made.dev && st.ino === made.ino))) return fd;
+  closeSync(fd);
+  if (st?.isSymbolicLink()) takeBack(path, made);
+  throw eexist(path);
+}
+
+const eexist = (path) => Object.assign(new Error(`EEXIST: file already exists, open '${path}'`), { code: "EEXIST", path });
+
+// Removes the file an open made through the link at path, while it is still that empty file.
+function takeBack(path, made) {
+  try {
+    const target = realpathSync(path);
+    const st = statSync(target, { bigint: true });
+    if (st.dev === made.dev && st.ino === made.ino && st.size === 0n) rmSync(target, { force: true });
+  } catch {
+    // the link changed again: nothing of ours to find
+  }
+}
+
+// Writes bytes to a file not there yet (openFresh) and closes it. A write that fails takes the empty file away again
+// while the name is still that file, so no empty file stands for a first original later.
+function writeFresh(path, bytes, mode) {
+  const fd = openFresh(path, mode);
   try {
     writeFileSync(fd, bytes);
+  } catch (e) {
+    try {
+      const made = fstatSync(fd, { bigint: true });
+      const st = lstatSync(path, { bigint: true, throwIfNoEntry: false });
+      if (st && st.isFile() && st.dev === made.dev && st.ino === made.ino) rmSync(path, { force: true });
+    } catch {
+      // cannot tell the name is still that file: it stays, and the write's own error is what is reported
+    }
+    throw e;
   } finally {
     closeSync(fd);
   }
-  return bak;
 }
 
-/** Writes what planBlock worked out. A plan that changes nothing or was refused is returned as a result. */
+// Why the backup spot cannot take the first original, or null: something that is not a regular file there, or a look
+// that fails (EPERM on Windows for a .bak being deleted, and the like).
+function backupSpotWhy(bak) {
+  try {
+    const st = lstatSync(bak, { throwIfNoEntry: false });
+    return st && !st.isFile() ? "백업 자리에 일반 파일이 아닌 것이 있어 그대로 둠" : null;
+  } catch (e) {
+    return `백업 자리를 확인하지 못해 그대로 둠(${e.code || e.message})`;
+  }
+}
+
+// Keeps the first original: writes <file>.<skill>.bak only when nothing is at that name yet. { bak } (null when a
+// regular file there is the first original already), or { refuse } when something else is there (a link, a folder):
+// then the file is not changed, as its original would have nowhere to go.
+function backup(file, skill, bytes) {
+  const bak = `${file}.${skill}.bak`;
+  const there = (st) => (st.isFile() ? { bak: null } : { refuse: refusal("backup", `백업 자리에 일반 파일이 아닌 것이 있어 그대로 둠: ${bak}`, file) });
+  const st = lstatSync(bak, { throwIfNoEntry: false });
+  if (st) return there(st);
+  try {
+    writeFresh(bak, bytes, BACKUP_MODE);
+  } catch (e) {
+    if (e?.code !== "EEXIST") throw e;
+    const now = lstatSync(bak, { throwIfNoEntry: false }); // made since the look
+    return now ? there(now) : { refuse: refusal("backup", `백업을 만들지 못해 그대로 둠: ${bak}`, file) };
+  }
+  return { bak };
+}
+
+/**
+ * Writes what planBlock worked out. A plan that changes nothing or was refused is returned as a result. A file planned
+ * as new that is there by the write (made or linked since the plan) is not touched: the result is a refusal with
+ * raced: true, which applyBlocks answers by planning that file again.
+ */
 export function commitBlock(plan, skill) {
   if (!plan.ok) return plan;
   const result = { ok: true, changed: plan.changed, path: plan.path, file: plan.file };
   if (!plan.changed) return { ...result, message: `변경 없음: ${plan.path}` };
   if (plan.before === null && plan.after !== null) {
-    const fd = openSync(plan.file, "wx", plan.mode);
     try {
-      writeFileSync(fd, plan.after);
-    } finally {
-      closeSync(fd);
+      writeFresh(plan.file, plan.after, plan.mode);
+    } catch (e) {
+      if (e?.code !== "EEXIST") throw e;
+      return { ...refusal("raced", `계획한 뒤 그 이름에 파일이나 링크가 생겨 그대로 둠: ${plan.path}`, plan.path), raced: true };
     }
     return { ...result, created: true, message: `새로 만듦: ${plan.path}` };
   }
-  const bak = backup(plan.file, skill, plan.before);
+  const kept = backup(plan.file, skill, plan.before);
+  if (kept.refuse) return kept.refuse;
   writeAtomic(plan.file, plan.after, plan.mode);
-  return { ...result, backup: bak, message: `바꿈: ${plan.path}` };
+  return { ...result, backup: kept.bak, message: `바꿈: ${plan.path}` };
 }
 
 /** Puts in, replaces or (body null) takes out the block in one file. dryRun plans only. */
@@ -306,16 +401,33 @@ export function applyBlock(path, opts) {
 /**
  * Applies blocks to several files, each entry { path, ...opts }. Every file is planned first: one refusal and
  * none is written. Two entries naming one file (after links are followed) write it once, by the first entry.
+ * A file that changes between the plans and the writes (raced) is planned again; a refusal then comes back as
+ * { ok: false, partial: true }, the entries before it being written already.
  */
 export function applyBlocks(entries, { dryRun = false } = {}) {
   const plans = entries.map((e) => ({ entry: e, plan: planBlock(e.path, e) }));
   const refused = plans.filter((p) => !p.plan.ok).map((p) => p.plan);
   if (refused.length > 0) return { ok: false, refused, results: plans.map((p) => p.plan) };
   const seen = new Map();
-  const results = plans.map(({ entry, plan }) => {
-    if (seen.has(plan.key)) return { ok: true, changed: false, path: plan.path, file: plan.file, sameAs: seen.get(plan.key), message: `같은 파일이라 한 번만 씀: ${plan.path}` };
+  const once = (plan) => ({ ok: true, changed: false, path: plan.path, file: plan.file, sameAs: seen.get(plan.key), message: `같은 파일이라 한 번만 씀: ${plan.path}` });
+  const write = (entry, plan) => {
+    const done = dryRun ? plan : commitBlock(plan, entry.skill);
+    if (!done.ok) return done;
     seen.set(plan.key, plan.path);
-    return dryRun ? plan : commitBlock(plan, entry.skill);
+    const now = done.created ? keyNow(plan.file) : null; // a file made now is that file to later spellings too
+    if (now && !seen.has(now)) seen.set(now, plan.path);
+    return done;
+  };
+  const results = plans.map(({ entry, plan }) => {
+    if (seen.has(plan.key)) return once(plan);
+    const done = write(entry, plan);
+    if (!done.raced) return done;
+    // Made since the plan: by an earlier entry under another spelling (a case-insensitive file system), or by another
+    // program. Plan it again as what is there now.
+    const again = planBlock(entry.path, entry);
+    if (!again.ok) return again;
+    return seen.has(again.key) ? once(again) : write(entry, again);
   });
-  return { ok: true, refused: [], results };
+  const late = results.filter((r) => r.ok === false);
+  return late.length > 0 ? { ok: false, partial: true, refused: late, results } : { ok: true, refused: [], results };
 }

package/skills/init-dir/scripts/init-dir.mjs

@@ -93,12 +93,35 @@ const real = (p) => {
   }
 };
 
+// Whether a and b are one folder: device and inode (bigint, as NTFS file ids pass 2^53), or where the file system has
+// no inode numbers, the path as the file system spells it (realpathSync.native gives one spelling for names that differ
+// only in case, an 8.3 short name or a linked parent), case folded on Windows and macOS. A string compare of the JS
+// realpath let `--root c:\users\me` (or /users/me on macOS) pass the HOME refusal.
+function sameDir(a, b) {
+  try {
+    const x = statSync(a, { bigint: true });
+    const y = statSync(b, { bigint: true });
+    if (x.ino !== 0n && y.ino !== 0n) return x.dev === y.dev && x.ino === y.ino;
+  } catch {
+    // one is gone: the spellings below decide
+  }
+  const spell = (p) => {
+    try {
+      return realpathSync.native(p);
+    } catch {
+      return real(p);
+    }
+  };
+  const fold = (p) => (process.platform === "win32" || process.platform === "darwin" ? p.toLowerCase() : p);
+  return fold(spell(a)) === fold(spell(b));
+}
+
 // The root folder, or a failure: missing (2), HOME or a file system root (3).
 function checkRoot(rootArg) {
   const root = resolve(rootArg);
   if (!statSync(root, { throwIfNoEntry: false })?.isDirectory()) return fail(2, `루트 폴더가 없음: ${root}`);
   const r = real(root);
-  if (r === real(homedir())) return fail(3, `루트가 HOME 이라 거부: ${root}. 프로젝트 폴더에서 실행하거나 --root 로 지정`);
+  if (sameDir(root, homedir())) return fail(3, `루트가 HOME 이라 거부: ${root}. 프로젝트 폴더에서 실행하거나 --root 로 지정`);
   if (parse(r).root === r) return fail(3, `루트가 파일 시스템 루트라 거부: ${root}`);
   return { root };
 }
@@ -165,6 +188,7 @@ const blockEntries = (root, files, present, follow) =>
   }));
 
 function instructionStatus(r) {
+  if (r.ok === false) return `refused:${r.refused}`;
   if (r.sameAs) return "same-file";
   if (!r.changed) return "unchanged";
   return r.created || r.before === null ? "created" : "updated";
@@ -227,7 +251,10 @@ function apply(o) {
   if (p.error) return p;
   const folders = o.dryRun ? plannedFolders(p.folders) : makeFolders(p.root, p.folders);
   const done = o.dryRun ? p.plan : applyBlocks(p.entries);
-  if (!done.ok) return fail(1, `지시 파일 거부: ${done.refused.map((r) => r.message).join("; ")}. 폴더는 만들었음`);
+  if (!done.ok) {
+    const wrote = done.partial ? done.results.filter((r) => r.ok && r.changed).map((r) => r.path) : [];
+    return fail(1, `지시 파일 거부: ${done.refused.map((r) => r.message).join("; ")}. 폴더는 만들었음${wrote.length ? `. 이미 쓴 파일: ${wrote.join(", ")}` : ""}`);
+  }
   const instructions = done.results.map((r, i) => ({ file: p.entries[i].name, status: instructionStatus(r) }));
   const warnings = [...p.warnings, ...leftoverWarnings(p.root)];
   return { code: 0, report: { ok: true, command: "apply", root: p.root, runtime: o.runtime, dryRun: o.dryRun, folders, instructions, warnings, present: p.present } };

package/skills/init-dir/scripts/marker-block.mjs

@@ -20,7 +20,7 @@
  *   file. Windows has no owner or permission bits to check.
  * - Writes go to a temp file in the same folder and a rename. A failed write removes the temp file.
  * - When the bytes change, the first original is kept in `<file>.<skill>.bak`; an existing backup is never
- *   overwritten.
+ *   overwritten. Something else at that name (a link, a folder) refuses the change (backup), so no original is lost.
  *
  * Results are { ok, changed, refused?, message, path, file }. Callers map refused to exit status 1.
  */
@@ -220,9 +220,25 @@ const options = (opts) => ({
   wrap: opts.wrap ?? null,
   skill: opts.skill,
   follow: opts.followSymlink === true,
+  readOnly: opts.readOnly === true, // a plan only read (never committed): no backup spot to check
   uid: "uid" in opts ? opts.uid : process.getuid?.(),
 });
 
+// A file not there yet is named by its folder as the file system spells it (one key for a linked parent, an 8.3 name
+// or the folder in another case) and its own name as given. Two names differing only in case still get two keys:
+// where the file system takes them for one file, applyBlocks meets that when the second create finds the first.
+const newFileKey = (file) => `path:${join(nativeReal(dirname(resolve(file))), basename(file))}`;
+
+// The key of a file that is there now, as planBlock gives it, or null when it cannot be read.
+function keyNow(file) {
+  try {
+    const id = statSync(file, { bigint: true });
+    return id.ino === 0n ? `path:${nativeReal(file)}` : `ino:${id.dev}:${id.ino}`;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Works out what applyBlock would write, without writing: { ok, changed, refused?, message, path, file, key,
  * before, after, mode }. key names the file (device and inode, or the path of a file not there yet).
@@ -234,13 +250,17 @@ export function planBlock(path, opts) {
   if (at.refuse) return at.refuse;
   if (!at.exists) {
     const after = o.body === null ? null : Buffer.from(blockText(o.mk, o.body, o.wrap, "\n"), "utf8");
-    return { ok: true, changed: after !== null, path, file: at.file, key: `path:${resolve(at.file)}`, before: null, after, mode: NEW_FILE_MODE };
+    return { ok: true, changed: after !== null, path, file: at.file, key: newFileKey(at.file), before: null, after, mode: NEW_FILE_MODE };
   }
   const read = readChecked(at.file, o.uid);
   if (read.refuse) return read.refuse;
   const next = nextBytes(read.bytes, o, at.file);
   if (next.refuse) return next.refuse;
   const changed = !next.bytes.equals(read.bytes);
+  // A change keeps the first original in <file>.<skill>.bak: something else there (a link, a folder) is refused now,
+  // in the plan, so a dry run, a status and a check say so before anything is written.
+  const bakWhy = changed && !o.readOnly ? backupSpotWhy(`${at.file}.${o.skill}.bak`) : null;
+  if (bakWhy) return refusal("backup", `${bakWhy}: ${at.file}.${o.skill}.bak`, path);
   // ino 0 (a file system without file ids) tells nothing apart: then the path as the file system spells it is the
   // key (realpathSync.native gives one spelling for names that differ only in case where case is ignored).
   const key = read.id.ino === 0n ? `path:${nativeReal(at.file)}` : `ino:${read.id.dev}:${read.id.ino}`;
@@ -264,36 +284,111 @@ function writeAtomic(file, data, mode) {
   }
 }
 
-// Keeps the first original: writes <file>.<skill>.bak only when nothing is at that name yet.
-function backup(file, skill, bytes) {
-  const bak = `${file}.${skill}.bak`;
-  if (lstatSync(bak, { throwIfNoEntry: false })) return null;
-  const fd = openSync(bak, "wx", BACKUP_MODE);
+// Opens a file not there yet, as "wx" does, and makes sure the name is the file made. Anything at the name, a link to
+// nothing among them, is EEXIST: Windows opens "wx" through a link to nothing and makes the file it leads to (macOS
+// and Linux answer EEXIST), so the name is looked at first, and a link planted between that look and the open is
+// caught after it by comparing the opened file with the name; the empty file made through it is taken back.
+function openFresh(path, mode) {
+  if (lstatSync(path, { throwIfNoEntry: false })) throw eexist(path);
+  const fd = openSync(path, "wx", mode);
+  let made;
+  let st;
+  try {
+    made = fstatSync(fd, { bigint: true });
+    st = lstatSync(path, { bigint: true, throwIfNoEntry: false });
+  } catch {
+    return fd; // cannot look (ESTALE, EPERM): the file is the caller's, as a plain "wx" leaves it
+  }
+  if (st && !st.isSymbolicLink() && (made.ino === 0n || (st.dev === made.dev && st.ino === made.ino))) return fd;
+  closeSync(fd);
+  if (st?.isSymbolicLink()) takeBack(path, made);
+  throw eexist(path);
+}
+
+const eexist = (path) => Object.assign(new Error(`EEXIST: file already exists, open '${path}'`), { code: "EEXIST", path });
+
+// Removes the file an open made through the link at path, while it is still that empty file.
+function takeBack(path, made) {
+  try {
+    const target = realpathSync(path);
+    const st = statSync(target, { bigint: true });
+    if (st.dev === made.dev && st.ino === made.ino && st.size === 0n) rmSync(target, { force: true });
+  } catch {
+    // the link changed again: nothing of ours to find
+  }
+}
+
+// Writes bytes to a file not there yet (openFresh) and closes it. A write that fails takes the empty file away again
+// while the name is still that file, so no empty file stands for a first original later.
+function writeFresh(path, bytes, mode) {
+  const fd = openFresh(path, mode);
   try {
     writeFileSync(fd, bytes);
+  } catch (e) {
+    try {
+      const made = fstatSync(fd, { bigint: true });
+      const st = lstatSync(path, { bigint: true, throwIfNoEntry: false });
+      if (st && st.isFile() && st.dev === made.dev && st.ino === made.ino) rmSync(path, { force: true });
+    } catch {
+      // cannot tell the name is still that file: it stays, and the write's own error is what is reported
+    }
+    throw e;
   } finally {
     closeSync(fd);
   }
-  return bak;
 }
 
-/** Writes what planBlock worked out. A plan that changes nothing or was refused is returned as a result. */
+// Why the backup spot cannot take the first original, or null: something that is not a regular file there, or a look
+// that fails (EPERM on Windows for a .bak being deleted, and the like).
+function backupSpotWhy(bak) {
+  try {
+    const st = lstatSync(bak, { throwIfNoEntry: false });
+    return st && !st.isFile() ? "백업 자리에 일반 파일이 아닌 것이 있어 그대로 둠" : null;
+  } catch (e) {
+    return `백업 자리를 확인하지 못해 그대로 둠(${e.code || e.message})`;
+  }
+}
+
+// Keeps the first original: writes <file>.<skill>.bak only when nothing is at that name yet. { bak } (null when a
+// regular file there is the first original already), or { refuse } when something else is there (a link, a folder):
+// then the file is not changed, as its original would have nowhere to go.
+function backup(file, skill, bytes) {
+  const bak = `${file}.${skill}.bak`;
+  const there = (st) => (st.isFile() ? { bak: null } : { refuse: refusal("backup", `백업 자리에 일반 파일이 아닌 것이 있어 그대로 둠: ${bak}`, file) });
+  const st = lstatSync(bak, { throwIfNoEntry: false });
+  if (st) return there(st);
+  try {
+    writeFresh(bak, bytes, BACKUP_MODE);
+  } catch (e) {
+    if (e?.code !== "EEXIST") throw e;
+    const now = lstatSync(bak, { throwIfNoEntry: false }); // made since the look
+    return now ? there(now) : { refuse: refusal("backup", `백업을 만들지 못해 그대로 둠: ${bak}`, file) };
+  }
+  return { bak };
+}
+
+/**
+ * Writes what planBlock worked out. A plan that changes nothing or was refused is returned as a result. A file planned
+ * as new that is there by the write (made or linked since the plan) is not touched: the result is a refusal with
+ * raced: true, which applyBlocks answers by planning that file again.
+ */
 export function commitBlock(plan, skill) {
   if (!plan.ok) return plan;
   const result = { ok: true, changed: plan.changed, path: plan.path, file: plan.file };
   if (!plan.changed) return { ...result, message: `변경 없음: ${plan.path}` };
   if (plan.before === null && plan.after !== null) {
-    const fd = openSync(plan.file, "wx", plan.mode);
     try {
-      writeFileSync(fd, plan.after);
-    } finally {
-      closeSync(fd);
+      writeFresh(plan.file, plan.after, plan.mode);
+    } catch (e) {
+      if (e?.code !== "EEXIST") throw e;
+      return { ...refusal("raced", `계획한 뒤 그 이름에 파일이나 링크가 생겨 그대로 둠: ${plan.path}`, plan.path), raced: true };
     }
     return { ...result, created: true, message: `새로 만듦: ${plan.path}` };
   }
-  const bak = backup(plan.file, skill, plan.before);
+  const kept = backup(plan.file, skill, plan.before);
+  if (kept.refuse) return kept.refuse;
   writeAtomic(plan.file, plan.after, plan.mode);
-  return { ...result, backup: bak, message: `바꿈: ${plan.path}` };
+  return { ...result, backup: kept.bak, message: `바꿈: ${plan.path}` };
 }
 
 /** Puts in, replaces or (body null) takes out the block in one file. dryRun plans only. */
@@ -306,16 +401,33 @@ export function applyBlock(path, opts) {
 /**
  * Applies blocks to several files, each entry { path, ...opts }. Every file is planned first: one refusal and
  * none is written. Two entries naming one file (after links are followed) write it once, by the first entry.
+ * A file that changes between the plans and the writes (raced) is planned again; a refusal then comes back as
+ * { ok: false, partial: true }, the entries before it being written already.
  */
 export function applyBlocks(entries, { dryRun = false } = {}) {
   const plans = entries.map((e) => ({ entry: e, plan: planBlock(e.path, e) }));
   const refused = plans.filter((p) => !p.plan.ok).map((p) => p.plan);
   if (refused.length > 0) return { ok: false, refused, results: plans.map((p) => p.plan) };
   const seen = new Map();
-  const results = plans.map(({ entry, plan }) => {
-    if (seen.has(plan.key)) return { ok: true, changed: false, path: plan.path, file: plan.file, sameAs: seen.get(plan.key), message: `같은 파일이라 한 번만 씀: ${plan.path}` };
+  const once = (plan) => ({ ok: true, changed: false, path: plan.path, file: plan.file, sameAs: seen.get(plan.key), message: `같은 파일이라 한 번만 씀: ${plan.path}` });
+  const write = (entry, plan) => {
+    const done = dryRun ? plan : commitBlock(plan, entry.skill);
+    if (!done.ok) return done;
     seen.set(plan.key, plan.path);
-    return dryRun ? plan : commitBlock(plan, entry.skill);
+    const now = done.created ? keyNow(plan.file) : null; // a file made now is that file to later spellings too
+    if (now && !seen.has(now)) seen.set(now, plan.path);
+    return done;
+  };
+  const results = plans.map(({ entry, plan }) => {
+    if (seen.has(plan.key)) return once(plan);
+    const done = write(entry, plan);
+    if (!done.raced) return done;
+    // Made since the plan: by an earlier entry under another spelling (a case-insensitive file system), or by another
+    // program. Plan it again as what is there now.
+    const again = planBlock(entry.path, entry);
+    if (!again.ok) return again;
+    return seen.has(again.key) ? once(again) : write(entry, again);
   });
-  return { ok: true, refused: [], results };
+  const late = results.filter((r) => r.ok === false);
+  return late.length > 0 ? { ok: false, partial: true, refused: late, results } : { ok: true, refused: [], results };
 }