@signalridge/pi-goal 1.4.0 → 1.4.1

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # @signalridge/pi-goal
 
+## 1.4.1
+### Patch Changes
+
+- c1b1741: Durability and containment fixes found in a repository-wide scan.
+  
+  `pi-gpt-fast` rewrote pi's own global `settings.json` with a plain
+  `writeFileSync`. That file is shared with pi and every other extension, and this
+  one is the only writer of it; a torn write would have left the user with no pi
+  configuration at all rather than just no gpt-fast setting. It now writes a temp
+  file and renames, matching every other settings writer in the repository.
+  `pi-goal` gets the same treatment for its cross-project goal state file, which
+  its own settings module already did.
+  
+  `pi-ralph-wiggum` resolved `/ralph start <path>` straight against the session
+  cwd, so `../../notes.md` would create directories and a file outside the project
+  the user opened — silently, before the loop started. This extension drives long
+  unattended loops, so that command is as likely to come from a model as from a
+  person. Task-file paths are now required to stay inside the workspace, on the
+  command, on the `ralph_start` tool, and on the paths read back out of persisted
+  state, so a state file written earlier or edited by hand cannot pull a file in
+  from outside either.
+  
+  The containment test canonicalizes both sides before comparing, because a purely
+  lexical one is defeated by a symlink: every segment of `linked/plan.md` reads as
+  inside the workspace when `linked` is a door out of it. `realpathSync` throws on
+  a path that does not exist yet — the ordinary case, since `start` is usually
+  creating the file — so it resolves the deepest existing ancestor and re-attaches
+  the not-yet-created suffix, which cannot itself be a link. The traversal test
+  matches a `..` segment rather than a `..` prefix; the prefix form also rejected
+  `..notes.md`, an ordinary filename sitting in the workspace.
+  
+  Every remaining bare `catch {}` now says why the error is safe to drop, matching
+  the convention the rest of the repository already follows.
+
 ## 1.4.0
 ### Minor Changes
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@signalridge/pi-goal",
-  "version": "1.4.0",
+  "version": "1.4.1",
   "description": "Pi extension for autonomous /goal completion with opt-in experimental ordered queues.",
   "type": "module",
   "license": "MIT",

package/src/persistence.ts

@@ -1,5 +1,6 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
 import { getAgentDir } from "@earendil-works/pi-coding-agent";
 import { isNonNegativeFiniteNumber, nonNegativeFiniteNumber, normalizeTokenBudget } from "./accounting.js";
 import type { GoalStatus } from "./prompts.js";
@@ -238,12 +239,28 @@ function normalizeSafetyPauseCause(value: unknown): SafetyPauseCause | undefined
   return value === "continuation_limit" || value === "no_progress" ? value : undefined;
 }
 
+/**
+ * Atomic for the same reason `saveGoalSettings` is: this file holds every
+ * project's goal state, so a torn write while clearing one project's entry
+ * would take the rest with it.
+ */
 export function clearLegacyPersistedGoal(cwd: string) {
   if (!existsSync(STATE_FILE)) return;
   const goals = readState();
   delete goals[cwd];
-  mkdirSync(dirname(STATE_FILE), { recursive: true });
-  writeFileSync(STATE_FILE, `${JSON.stringify(goals, null, 2)}\n`);
+  const document = `${JSON.stringify(goals, null, 2)}\n`;
+  const temporaryPath = join(dirname(STATE_FILE), `.${basename(STATE_FILE)}.${randomUUID()}.tmp`);
+  try {
+    mkdirSync(dirname(STATE_FILE), { recursive: true });
+    writeFileSync(temporaryPath, document, { encoding: "utf8", flag: "wx" });
+    renameSync(temporaryPath, STATE_FILE);
+  } finally {
+    try {
+      rmSync(temporaryPath, { force: true });
+    } catch {
+      // Best-effort cleanup must not replace the clear result.
+    }
+  }
 }
 
 function readState(): Record<string, unknown> {