@kitkat-vn/kitcode 0.2.0-staging.3

package/src/hook-installers.mjs

@@ -0,0 +1,397 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import {isDeepStrictEqual} from 'node:util';
+import {writeFileAtomically} from './atomic-file.mjs';
+import {
+  hookConfigFor,
+  hookCommandFor as specHookCommandFor,
+  legacyHookCommandFor,
+  sourceConfig as integrationSourceConfig,
+} from './integration-spec.mjs';
+import {runnerPath} from './runner-installer.mjs';
+
+// ~/.claude/settings.json and ~/.codex/hooks.json belong to the user (hard rule 3). KitCode refuses
+// to write a file it cannot parse or that the user made read-only, keeps every key it did not add,
+// and backs up the exact previous bytes before every write.
+const NEW_CONFIG_MODE = 0o600;
+
+export class ConfigFileError extends Error {
+  constructor(filePath, problem, cause) {
+    super(`${filePath} ${problem}`, {cause});
+    this.name = 'ConfigFileError';
+    this.filePath = filePath;
+    this.problem = problem;
+  }
+}
+
+function configPath(source) {
+  return path.join(os.homedir(), ...integrationSourceConfig(source).hookConfigPathParts);
+}
+
+function isObject(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function isSymbolicLink(filePath) {
+  try {
+    return fs.lstatSync(filePath).isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
+
+// The file's indentation and final newline, so that a rewrite changes only KitCode's entry.
+function formatOf(text) {
+  const indent = /^([ \t]+)"/m.exec(text)?.[1] ?? (text.includes('\n') ? 2 : 0);
+
+  return {indent, finalNewline: text.endsWith('\n')};
+}
+
+function serializeConfig(config, format) {
+  return `${JSON.stringify(config, null, format.indent)}${format.finalNewline ? '\n' : ''}`;
+}
+
+// A missing file reads as {exists: false}. Anything else KitCode cannot read, parse, or merge into
+// throws ConfigFileError: it is never taken for an empty config.
+function readConfig(filePath) {
+  let stat;
+  let realPath;
+
+  try {
+    stat = fs.statSync(filePath);
+    realPath = fs.realpathSync(filePath);
+  } catch (error) {
+    if (error.code === 'ENOENT' && !isSymbolicLink(filePath)) {
+      return {exists: false, filePath, realPath: filePath};
+    }
+
+    throw new ConfigFileError(filePath, error.code === 'ENOENT'
+      ? 'is a symbolic link to a file that does not exist'
+      : `could not be read (${error.code})`, error);
+  }
+
+  if (!stat.isFile()) {
+    throw new ConfigFileError(filePath, 'is not a regular file');
+  }
+
+  let bytes;
+
+  try {
+    bytes = fs.readFileSync(realPath);
+  } catch (error) {
+    throw new ConfigFileError(filePath, `could not be read (${error.code})`, error);
+  }
+
+  const text = bytes.toString('utf8');
+  let config;
+
+  try {
+    config = JSON.parse(text);
+  } catch (error) {
+    throw new ConfigFileError(filePath, `is not valid JSON (${error.message})`, error);
+  }
+
+  if (!isObject(config)) {
+    throw new ConfigFileError(filePath, 'does not hold a JSON object');
+  }
+
+  if (config.hooks !== undefined && !isObject(config.hooks)) {
+    throw new ConfigFileError(filePath, 'has a "hooks" value that is not an object');
+  }
+
+  if (config.hooks?.UserPromptSubmit !== undefined && !Array.isArray(config.hooks.UserPromptSubmit)) {
+    throw new ConfigFileError(filePath, 'has a "hooks.UserPromptSubmit" value that is not a list');
+  }
+
+  return {exists: true, filePath, realPath, bytes, config, mode: stat.mode & 0o777, format: formatOf(text)};
+}
+
+// A file the user made read-only is theirs to change, not KitCode's. A rename replaces a file whatever
+// its mode, as long as its folder is writable, so the file itself is asked: for a symbolic link, the
+// file it points to. The mode, a lock (chflags uchg), an ACL and a read-only disk all count. Returns
+// why KitCode may not write the file, or null.
+function readOnlyRefusal(current) {
+  try {
+    fs.accessSync(current.realPath, fs.constants.W_OK);
+    return null;
+  } catch (error) {
+    if (!['EACCES', 'EPERM', 'EROFS'].includes(error.code)) {
+      throw error;
+    }
+
+    const problem = isSymbolicLink(current.filePath) ? `links to ${current.realPath}, which is read-only` : 'is read-only';
+    return Object.assign(new ConfigFileError(current.filePath, problem, error), {readOnly: true});
+  }
+}
+
+// A copy of the exact bytes KitCode read, with the file's own mode, next to the path the agent
+// reads (not inside the folder a symbolic link points into). Never overwrites an earlier backup.
+function backUp(current) {
+  const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+
+  for (let attempt = 0; ; attempt += 1) {
+    const backupPath = `${current.filePath}.kitcode-${stamp}${attempt > 0 ? `-${attempt}` : ''}.bak`;
+    let fd;
+
+    try {
+      fd = fs.openSync(backupPath, 'wx', 0o600);
+    } catch (error) {
+      if (error.code === 'EEXIST') {
+        continue;
+      }
+
+      throw error;
+    }
+
+    try {
+      fs.fchmodSync(fd, current.mode);
+      fs.writeFileSync(fd, current.bytes);
+      fs.fsyncSync(fd);
+    } finally {
+      fs.closeSync(fd);
+    }
+
+    return backupPath;
+  }
+}
+
+// Replaces the file with `config`: a backup of the previous bytes first, then an atomic write that
+// keeps the file's mode. A new file is created 0600, with the folder it needs. A read-only file is
+// refused before anything is written, its backup included.
+function writeConfig(current, config) {
+  const format = current.exists ? current.format : {indent: 2, finalNewline: true};
+  let backupPath = null;
+
+  if (current.exists) {
+    const readOnly = readOnlyRefusal(current);
+
+    if (readOnly) {
+      throw readOnly;
+    }
+
+    // A user, or the agent itself, may have saved the file since KitCode read it.
+    if (!fs.readFileSync(current.realPath).equals(current.bytes)) {
+      throw new ConfigFileError(current.filePath, 'changed while KitCode was updating it; run the command again');
+    }
+
+    backupPath = backUp(current);
+  } else {
+    fs.mkdirSync(path.dirname(current.realPath), {recursive: true});
+  }
+
+  writeFileAtomically(current.realPath, serializeConfig(config, format), {mode: current.exists ? current.mode : NEW_CONFIG_MODE});
+  return backupPath;
+}
+
+function asConfigFileError(filePath, error) {
+  return error instanceof ConfigFileError
+    ? error
+    : new ConfigFileError(filePath, `could not be written (${error.code ?? error.message})`, error);
+}
+
+function hookCommandFor(source) {
+  return specHookCommandFor(source, {runnerPath: runnerPath()});
+}
+
+function createKitCodeHook(source) {
+  return hookConfigFor(source, {runnerPath: runnerPath()});
+}
+
+function isKitCodeHook(source, hook) {
+  return hook?.type === 'command' && (
+    hook.command === hookCommandFor(source) ||
+    hook.command === specHookCommandFor(source) ||
+    hook.command === legacyHookCommandFor(source) ||
+    // What KitCode wrote on Windows before 2026-09-29: the runner's path quoted for sh, which PowerShell
+    // cannot parse (docs/security.md, "The prompt hook on Windows"). `on` replaces it and `off` removes
+    // it. Elsewhere it is the command itself.
+    hook.command === specHookCommandFor(source, {runnerPath: runnerPath(), platform: 'linux'})
+  );
+}
+
+function hasKitCodeHook(source, group) {
+  return isObject(group) && Array.isArray(group.hooks) && group.hooks.some((hook) => isKitCodeHook(source, hook));
+}
+
+// The KitCode entries in hooks.UserPromptSubmit, as they are in the file.
+function kitCodeEntries(source, config) {
+  const groups = Array.isArray(config.hooks?.UserPromptSubmit) ? config.hooks.UserPromptSubmit : [];
+
+  return groups
+    .filter((group) => hasKitCodeHook(source, group))
+    .flatMap((group) => group.hooks.filter((hook) => isKitCodeHook(source, hook)));
+}
+
+// What to add by hand when KitCode may not write the file itself.
+export function manualHookSnippet(source) {
+  return {
+    hooks: {
+      UserPromptSubmit: [
+        {
+          matcher: '',
+          hooks: [createKitCodeHook(source)],
+        },
+      ],
+    },
+  };
+}
+
+// Leaves exactly one KitCode entry, `entry`, in hooks.UserPromptSubmit. An existing KitCode entry
+// is replaced where it stands; any others go, with groups that only held them. Returns whether the
+// config changed.
+function placeKitCodeHook(source, config, entry) {
+  const groups = Array.isArray(config.hooks?.UserPromptSubmit) ? config.hooks.UserPromptSubmit : [];
+  const nextGroups = [];
+  let placed = false;
+  let changed = false;
+
+  for (const group of groups) {
+    if (!hasKitCodeHook(source, group)) {
+      nextGroups.push(group);
+      continue;
+    }
+
+    const hooks = [];
+
+    for (const hook of group.hooks) {
+      if (!isKitCodeHook(source, hook)) {
+        hooks.push(hook);
+      } else if (!placed) {
+        placed = true;
+        changed ||= !isDeepStrictEqual(hook, entry);
+        hooks.push(entry);
+      } else {
+        changed = true;
+      }
+    }
+
+    if (hooks.length > 0) {
+      nextGroups.push({...group, hooks});
+    } else {
+      changed = true;
+    }
+  }
+
+  if (!placed) {
+    nextGroups.push({
+      matcher: '',
+      hooks: [entry],
+    });
+    changed = true;
+  }
+
+  if (changed) {
+    config.hooks = {...(isObject(config.hooks) ? config.hooks : {}), UserPromptSubmit: nextGroups};
+  }
+
+  return changed;
+}
+
+// Removes every KitCode entry from hooks.UserPromptSubmit, and the groups and keys that removing
+// them leaves empty. Returns whether there was anything to remove.
+function removeKitCodeHooks(source, config) {
+  const groups = config.hooks?.UserPromptSubmit;
+
+  if (!Array.isArray(groups) || !groups.some((group) => hasKitCodeHook(source, group))) {
+    return false;
+  }
+
+  const nextGroups = [];
+
+  for (const group of groups) {
+    if (!hasKitCodeHook(source, group)) {
+      nextGroups.push(group);
+      continue;
+    }
+
+    const hooks = group.hooks.filter((hook) => !isKitCodeHook(source, hook));
+
+    if (hooks.length > 0) {
+      nextGroups.push({...group, hooks});
+    }
+  }
+
+  if (nextGroups.length > 0) {
+    config.hooks.UserPromptSubmit = nextGroups;
+  } else {
+    delete config.hooks.UserPromptSubmit;
+  }
+
+  if (Object.keys(config.hooks).length === 0) {
+    delete config.hooks;
+  }
+
+  return true;
+}
+
+export function isHookInstalled(source) {
+  return hookStatus(source).installed === true;
+}
+
+// `action` is what happened: 'installed', 'unchanged' (already there), or 'refused' (the file was
+// left as it is; `error` says why). Refused because the file is read-only, it also has `entries`: the
+// KitCode entries already in the file, which the one added by hand replaces.
+export function installHook(source) {
+  const filePath = configPath(source);
+  const command = hookCommandFor(source);
+  let entries = [];
+
+  try {
+    const current = readConfig(filePath);
+    const config = current.exists ? current.config : {};
+    entries = kitCodeEntries(source, config);
+
+    if (!placeKitCodeHook(source, config, createKitCodeHook(source))) {
+      return {installed: true, action: 'unchanged', path: filePath, command};
+    }
+
+    const backupPath = writeConfig(current, config);
+    return {installed: true, action: 'installed', path: filePath, command, backupPath};
+  } catch (error) {
+    const refusal = asConfigFileError(filePath, error);
+    return {installed: false, action: 'refused', path: filePath, command, error: refusal, ...(refusal.readOnly ? {entries} : {})};
+  }
+}
+
+// `action`: 'removed', 'not-found' (no file, or no KitCode entry in it; nothing was written), or
+// 'refused' (the file was left as it is; `error` says why). Refused because the file is read-only, it
+// also has `entries`: the KitCode entries to delete by hand.
+export function uninstallHook(source) {
+  const filePath = configPath(source);
+  const command = hookCommandFor(source);
+  let entries = [];
+
+  try {
+    const current = readConfig(filePath);
+    entries = current.exists ? kitCodeEntries(source, current.config) : [];
+
+    if (!current.exists || !removeKitCodeHooks(source, current.config)) {
+      return {installed: false, action: 'not-found', path: filePath, command};
+    }
+
+    const backupPath = writeConfig(current, current.config);
+    return {installed: false, action: 'removed', path: filePath, command, backupPath};
+  } catch (error) {
+    const refusal = asConfigFileError(filePath, error);
+    return {installed: null, action: 'refused', path: filePath, command, error: refusal, ...(refusal.readOnly ? {entries} : {})};
+  }
+}
+
+// `installed` is null when the file cannot be read: that says nothing about the hook. A file KitCode
+// can read but may not write also has `error`, which says why, and `entries`, the KitCode entries in
+// it.
+export function hookStatus(source) {
+  const filePath = configPath(source);
+  const command = hookCommandFor(source);
+
+  try {
+    const current = readConfig(filePath);
+    const entries = current.exists ? kitCodeEntries(source, current.config) : [];
+    const readOnly = current.exists ? readOnlyRefusal(current) : null;
+
+    return {installed: entries.length > 0, path: filePath, command, ...(readOnly ? {error: readOnly, entries} : {})};
+  } catch (error) {
+    return {installed: null, path: filePath, command, error: asConfigFileError(filePath, error)};
+  }
+}

package/src/hook-prompt.mjs

@@ -0,0 +1,201 @@
+import path from 'node:path';
+import {spawn} from 'node:child_process';
+import {appendLogLine} from './log-file.mjs';
+import {formatBreakDuration, nextBreakReminder} from './next-break-reminder.mjs';
+import {getDiskRewardSummary, getReadyUnannouncedTiers, markTiersAnnounced} from './reward.mjs';
+import {STORE_DIR, StateLockError, withStateLock} from './store.mjs';
+import {isProcessAlive, readTrackerRecord} from './tracker-instance.mjs';
+import {problemSentences, TRACKER_STOPPED} from './tracker-problems.mjs';
+
+export const HOOK_LOG_PATH = path.join(STORE_DIR, 'hook.log');
+
+// The hook has 5 s in all (integration-spec.mjs). Another KitCode process holds the state lock for
+// milliseconds at a time; waiting longer than this means it is stuck, or busy with a large write.
+const HOOK_LOCK_TIMEOUT_MS = 1000;
+
+function isDisabled() {
+  return ['1', 'true', 'yes'].includes(String(process.env.KITCODE_HOOKS_OFF ?? '').toLowerCase());
+}
+
+function isKitCodeManagementPrompt(prompt) {
+  const trimmed = String(prompt ?? '').trim().toLowerCase();
+
+  return trimmed === 'kitcode' ||
+    trimmed.startsWith('kitcode ') ||
+    trimmed === '/kitcode' ||
+    trimmed.startsWith('/kitcode ');
+}
+
+// Bounded (log-file.mjs), and it never throws: the hook fails open even when logging fails.
+function logHookError(error) {
+  appendLogLine(HOOK_LOG_PATH, error?.stack ?? error?.message ?? String(error));
+}
+
+// What the hook says about the tracker, in fixed words only (tracker-problems.mjs): tracker.json is
+// the user's file, and only a pid, two times and problem codes are read from it.
+// The tracker writes tracker.json at least every 10 s; a minute without means it is stuck.
+const HEARTBEAT_STALE_MS = 60_000;
+
+function trackerContext(now = Date.now()) {
+  const record = readTrackerRecord();
+
+  if (!record || !isProcessAlive(record.pid)) {
+    return TRACKER_STOPPED;
+  }
+
+  // A tracker from before 2026-09-24 writes no heartbeat, and is taken at its word.
+  const heartbeat = Date.parse(record.heartbeatAt);
+
+  if (Number.isFinite(heartbeat) && now - heartbeat > HEARTBEAT_STALE_MS) {
+    return 'KitCode tracker is not responding, so focus time may not be counted.';
+  }
+
+  if (record.tracking !== 'degraded') {
+    return '';
+  }
+
+  return problemSentences(record.problems).join(' ');
+}
+
+function readStdin() {
+  return new Promise((resolve, reject) => {
+    let input = '';
+
+    process.stdin.setEncoding('utf8');
+    process.stdin.on('data', (chunk) => {
+      input += chunk;
+    });
+    process.stdin.on('error', reject);
+    process.stdin.on('end', () => resolve(input));
+  });
+}
+
+function notify(title, message) {
+  const command = process.platform === 'darwin'
+    ? {
+      bin: 'osascript',
+      args: ['-e', `display notification ${JSON.stringify(message)} with title ${JSON.stringify(title)}`],
+    }
+    : process.platform === 'win32'
+      ? {
+        bin: 'powershell.exe',
+        args: ['-NoProfile', '-Command', `[void][System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms'); [System.Windows.Forms.MessageBox]::Show(${JSON.stringify(message)}, ${JSON.stringify(title)})`],
+      }
+      : {
+        bin: 'notify-send',
+        args: [title, message],
+      };
+
+  try {
+    const child = spawn(command.bin, command.args, {
+      detached: true,
+      stdio: 'ignore',
+      windowsHide: true,
+    });
+
+    child.on('error', () => {});
+    child.unref();
+  } catch {
+    // Desktop notifications are best-effort.
+  }
+}
+
+function progressContextFor(reward) {
+  const nextBreak = reward.nextBreak ?? nextBreakReminder(reward);
+  const ready = reward.milestones.filter((entry) => entry.status === 'ready' && !entry.redeemed);
+  const parts = [
+    `KitCode progress: ${reward.totalEquals} = counted, ${formatBreakDuration(reward.earnedSeconds)} active.`,
+  ];
+
+  if (ready.length > 0) {
+    parts.push(`Reward ready at ${ready.map((entry) => `${entry.percent}%`).join(', ')}. Mention \`kitcode dashboard\` briefly after this turn.`);
+  }
+
+  if (nextBreak) {
+    const almost = nextBreak.almost ? ' Almost there.' : '';
+    const equalsCopy = nextBreak.equalsCopy ?? `${nextBreak.equalsLeft} = to break`;
+    const timeCopy = nextBreak.timeCopy ?? `${nextBreak.durationLeft} to break`;
+    parts.push(
+      `Next break milestone: ${nextBreak.percent}% (${nextBreak.progressPercent}% there; ${equalsCopy}; ${timeCopy}).${almost}`,
+    );
+    parts.push(`After this turn, briefly mention remaining progress in one short line like: ${nextBreak.mentionLine}`);
+  }
+
+  return parts.join(' ');
+}
+
+function hookOutputFor({tiers = [], reward = null}) {
+  const progressContext = [reward ? progressContextFor(reward) : '', trackerContext()].filter(Boolean).join(' ');
+
+  if (tiers.length === 0) {
+    return {
+      hookSpecificOutput: {
+        hookEventName: 'UserPromptSubmit',
+        additionalContext: progressContext,
+      },
+    };
+  }
+
+  const labels = tiers.map((tier) => `${tier.percent}%`).join(', ');
+  const command = 'kitcode dashboard';
+  const additionalContext = [
+    progressContext,
+    `KitCode break code ready (${labels}). Briefly tell the user they can open the dashboard with \`${command}\` after this turn.`,
+  ].filter(Boolean).join(' ');
+
+  return {
+    hookSpecificOutput: {
+      hookEventName: 'UserPromptSubmit',
+      additionalContext,
+    },
+  };
+}
+
+// What the hook reports, and the tiers it announces, from one read of state.json. The read and the
+// announcement happen under the state lock, so a tier is announced once per agent, and the file is
+// written only when something is announced. If the lock stays busy, progress is still reported from
+// a plain read, and the announcement waits for a later prompt.
+function collectPromptProgress(source) {
+  try {
+    return withStateLock(() => {
+      const reward = getDiskRewardSummary();
+      const readyTiers = getReadyUnannouncedTiers(source);
+
+      return {reward, announced: markTiersAnnounced(source, readyTiers)};
+    }, {lockTimeoutMs: HOOK_LOCK_TIMEOUT_MS});
+  } catch (error) {
+    if (!(error instanceof StateLockError)) {
+      throw error;
+    }
+
+    return {reward: getDiskRewardSummary(), announced: []};
+  }
+}
+
+export async function runPromptHook({source}) {
+  if (isDisabled()) {
+    return;
+  }
+
+  try {
+    const input = await readStdin();
+    const payload = JSON.parse(input || '{}');
+
+    if (isKitCodeManagementPrompt(payload.prompt)) {
+      return;
+    }
+
+    const {reward, announced} = collectPromptProgress(source);
+
+    if (announced.length === 0) {
+      process.stdout.write(`${JSON.stringify(hookOutputFor({reward}))}\n`);
+      return;
+    }
+
+    const label = announced.map((tier) => `${tier.percent}%`).join(', ');
+    notify('KitCode break code ready', `Milestone ${label} unlocked. Open kitcode dashboard.`);
+    process.stdout.write(`${JSON.stringify(hookOutputFor({tiers: announced, reward}))}\n`);
+  } catch (error) {
+    logHookError(error);
+  }
+}

package/src/install-id.mjs

@@ -0,0 +1,94 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import {syncDirectory} from './atomic-file.mjs';
+import {STORE_DIR} from './store.mjs';
+
+// The install id the claim bundle carries (docs/backend.md, "The contract"): a random version 4 UUID,
+// made once per HOME, in ~/.kitcode/install-id. It says which claims came from one install; it names no
+// person, machine or project.
+//
+// It has a file of its own, and is not in state.json, because 0.1.39 rewrites state.json from a copy
+// holding only the fields it knows (its runtime.mjs normalizeState keeps version, projects and
+// onboarding), so a field added there is gone the first time 0.1.39 runs `add`, `list` or `status`, or
+// its tracker saves. 0.1.39 never opens this file. `kitcode uninstall` deletes it with the rest of
+// ~/.kitcode.
+export const INSTALL_ID_PATH = path.join(STORE_DIR, 'install-id');
+export const INSTALL_ID_DISPLAY_PATH = '~/.kitcode/install-id';
+
+const INSTALL_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+const INSTALL_ID_MODE = 0o600;
+
+// An install-id file that cannot be read, or does not hold an install id.
+export class InstallIdError extends Error {
+  constructor(problem, cause) {
+    super(`KitCode cannot read ${INSTALL_ID_PATH}: ${problem}. KitCode has left it as it is: a new id would make this install look like another.`, {cause});
+    this.name = 'InstallIdError';
+  }
+}
+
+// The install id, or null when there is none yet. A file that cannot be read, or does not hold an
+// install id, throws an InstallIdError, and is never replaced.
+export function readInstallId() {
+  let text;
+
+  try {
+    text = fs.readFileSync(INSTALL_ID_PATH, 'utf8');
+  } catch (error) {
+    if (error.code === 'ENOENT') {
+      return null;
+    }
+
+    throw new InstallIdError(error.code ? `${error.code}` : String(error), error);
+  }
+
+  const id = text.endsWith('\n') ? text.slice(0, -1) : text;
+
+  if (!INSTALL_ID.test(id)) {
+    throw new InstallIdError('it does not hold an install id');
+  }
+
+  return id;
+}
+
+// Makes the install id, once per HOME, and returns it; one already made is returned as it is. Of two
+// processes making it at once, one id is kept: each writes its id whole to a temporary file, then links
+// that into place, which the filesystem refuses once the name is taken, and the one refused reads the
+// other's. The file is never written over, so no reader ever sees half an id or a second one.
+export function ensureInstallId() {
+  const existing = readInstallId();
+
+  if (existing !== null) {
+    return existing;
+  }
+
+  fs.mkdirSync(STORE_DIR, {recursive: true});
+  const id = crypto.randomUUID();
+  const tempPath = path.join(STORE_DIR, `.install-id.${process.pid}.${crypto.randomBytes(4).toString('hex')}.tmp`);
+  const fd = fs.openSync(tempPath, 'wx', INSTALL_ID_MODE);
+
+  try {
+    try {
+      fs.fchmodSync(fd, INSTALL_ID_MODE);
+      fs.writeFileSync(fd, `${id}\n`);
+      fs.fsyncSync(fd);
+    } finally {
+      fs.closeSync(fd);
+    }
+
+    try {
+      fs.linkSync(tempPath, INSTALL_ID_PATH);
+    } catch (error) {
+      if (error.code !== 'EEXIST') {
+        throw error;
+      }
+
+      return readInstallId();
+    }
+
+    syncDirectory(STORE_DIR);
+    return id;
+  } finally {
+    fs.rmSync(tempPath, {force: true});
+  }
+}