@magicpixelart/cli 0.5.2 → 0.5.3

package/CHANGELOG.md

@@ -7,6 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.5.3] — 2026-06-02
+
+### Fixed
+
+- **Continuous `.magicpixel/state.json.<pid>.<hex>.tmp` churn in watch mode.**
+  `saveState()` still used `atomicWrite`, and because watch mode persists
+  state every poll, editors like VS Code visibly filled `.magicpixel/` with
+  staged `state.json.*.tmp` files before the rename landed or when file
+  watchers raced the staging path. State saves now use a direct `writeFile`
+  with `0600` permissions instead. This is safe because `state.json` is a
+  recoverable cache: if a process dies mid-write, `loadState()` already
+  quarantines corrupt JSON and the next sync re-derives the snapshot from the
+  manifest and local files. `atomicWrite` remains for durable config,
+  credentials, `AGENTS.md`, package metadata, and generated index files.
+
 ## [0.5.2] — 2026-06-02
 
 ### Fixed

package/dist/config.js

@@ -1,4 +1,4 @@
-import { readFile, mkdir, rename } from 'node:fs/promises';
+import { readFile, mkdir, rename, writeFile, chmod } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import { assertSafeOutDir, MAX_GLOB_LEN, validateEndpointUrl } from './util/security.js';
@@ -151,11 +151,19 @@ export async function saveState(state, cwd = process.cwd()) {
     const path = statePath(cwd);
     try {
         await mkdir(dirname(path), { recursive: true });
-        // Atomic write: stage to a sibling tmp file then rename. Prevents a half-
-        // written state.json on crash/power-loss, which would then poison the next
-        // run (and require the corrupt-state recovery path above). Mode 0600
-        // because state.json sits next to the API-key-bearing credentials file.
-        await atomicWrite(path, JSON.stringify(state, null, 2) + '\n', { mode: 0o600 });
+        // state.json is saved on every watch tick, so it must not use a visible
+        // stage-and-rename tmp path (`state.json.<pid>.<hex>.tmp`) that churns in
+        // VS Code / Vite file watchers. A torn state write is recoverable: loadState
+        // quarantines corrupt JSON and the next sync re-derives state from disk +
+        // manifest, so direct writeFile is the safer UX trade-off here. Keep
+        // atomicWrite for durable config/credentials/index writers.
+        await writeFile(path, JSON.stringify(state, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
+        try {
+            await chmod(path, 0o600);
+        }
+        catch {
+            // Windows / read-only FS — ignore. The contents are non-secret sync state.
+        }
     }
     catch (e) {
         throw friendlyFsError(e, {

package/dist/util/atomicWrite.js

@@ -3,13 +3,13 @@ import { tmpPathFor } from './security.js';
 /**
  * Stage-and-rename file write. A crash mid-write can never leave a truncated
  * file on disk — the rename is atomic on every POSIX FS and on NTFS. Used
- * everywhere a corrupted target would break the project (state.json,
- * package.json, magicpixel.json, credentials, AGENTS.md, generated index files,
- * asset PNGs from `sync`).
+ * everywhere a corrupted target would break the project (package.json,
+ * magicpixel.json, credentials, AGENTS.md, generated index files). High-churn
+ * `state.json` saves and asset PNG writes intentionally use direct writeFile;
+ * see CHANGELOG 0.5.2/0.5.3 for the watcher/HMR trade-offs.
  *
- * Accepts `string | Uint8Array` so the asset-bytes writer in `sync` can reuse
- * this instead of duplicating the staging logic (one of the two prior leak
- * sites — see CHANGELOG 0.5.1).
+ * Accepts `string | Uint8Array` for callers that need binary-safe atomic
+ * writes, though asset bytes currently avoid this path for HMR compatibility.
  *
  * CRITICAL: On ANY failure between staging and rename, the tmp file is
  * unlinked before the original error is rethrown. Without this, every rare

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magicpixelart/cli",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "description": "Sync MagicPixel pixel-art assets to your local project.",
   "type": "module",
   "bin": {