@signalridge/pi-workflows 1.2.0 → 1.3.1

package/src/saved-workflows.ts

@@ -0,0 +1,121 @@
+/**
+ * saved-workflows.ts — persisted user workflows (A7).
+ *
+ * Layout: `~/.pi/workflows/projects/<basename>-<sha256(cwd)[0:12]>/saved/*.js`
+ * with a `settings.json` next to the run directory. Writes are atomic
+ * (temp file + rename) with a `.bak` backup kept before replacement. Names are
+ * validated against a bounded identifier pattern so a saved name can never
+ * escape the saved directory or collide with command registration.
+ */
+
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
+import { getAgentDir } from "@earendil-works/pi-coding-agent";
+
+/** Names a saved workflow; the same pattern feeds slash-command registration. */
+const SAVED_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+
+export function isValidSavedName(name: string): boolean {
+  return SAVED_NAME_PATTERN.test(name);
+}
+
+function projectDir(cwd: string): string {
+  const encoded = basename(resolve(cwd)) || "root";
+  const digest = createHash("sha256").update(resolve(cwd)).digest("hex").slice(0, 12);
+  return join(getAgentDir(), "workflows", "projects", `${encoded}-${digest}`);
+}
+
+function savedDir(cwd: string): string {
+  return join(projectDir(cwd), "saved");
+}
+
+function savedPath(name: string, cwd: string): string {
+  return join(savedDir(cwd), `${name}.js`);
+}
+
+function userSavedDir(): string {
+  return join(getAgentDir(), "workflows", "saved");
+}
+
+function userSavedPath(name: string): string {
+  return join(userSavedDir(), `${name}.js`);
+}
+
+/** Atomic write with backup: temp file + rename, keeping a .bak of the prior content. */
+function atomicWrite(path: string, content: string): void {
+  mkdirSync(dirname(path), { recursive: true });
+  const temporary = `${path}.${process.pid}.${Date.now().toString(36)}.tmp`;
+  if (existsSync(path)) {
+    try {
+      renameSync(path, `${path}.bak`);
+    } catch {
+      // Best-effort backup; the rename below still replaces the target.
+    }
+  }
+  writeFileSync(temporary, content, { encoding: "utf8", flag: "wx" });
+  renameSync(temporary, path);
+  try {
+    rmSync(`${path}.bak`, { force: true });
+  } catch {
+    // best-effort
+  }
+}
+
+/** Save a workflow script under `name`. Throws on invalid names. */
+export function saveWorkflow(name: string, script: string, cwd: string = process.cwd()): void {
+  if (!isValidSavedName(name)) {
+    throw new Error(
+      `Invalid workflow name "${name}": use letters, digits, and ._- only, at most 64 characters, no leading separator.`,
+    );
+  }
+  atomicWrite(savedPath(name, cwd), script);
+}
+
+/** Load a saved workflow script by name; undefined when absent or invalid. */
+export function loadSavedWorkflow(name: string, cwd: string = process.cwd()): string | undefined {
+  if (!isValidSavedName(name)) return undefined;
+  for (const path of [savedPath(name, cwd), userSavedPath(name)]) {
+    if (!existsSync(path)) continue;
+    try {
+      const content = readFileSync(path, "utf8");
+      if (content.length > 0 && content.length <= 200_000) return content;
+    } catch {
+      // Project errors do not hide a valid user-scope fallback.
+    }
+  }
+  return undefined;
+}
+
+/** List saved workflow names (bounded). */
+export function listSavedWorkflows(cwd: string = process.cwd()): string[] {
+  const names = new Set<string>();
+  for (const dir of [savedDir(cwd), userSavedDir()]) {
+    if (!existsSync(dir)) continue;
+    try {
+      for (const file of readdirSync(dir)) {
+        const name = file.endsWith(".js") ? basename(file, ".js") : "";
+        if (isValidSavedName(name)) names.add(name);
+      }
+    } catch {
+      // An unreadable scope is simply unavailable; the other scope still works.
+    }
+  }
+  return [...names].sort();
+}
+
+/** Remove a saved workflow; returns false when it did not exist. */
+export function removeSavedWorkflow(name: string, cwd: string = process.cwd()): boolean {
+  if (!isValidSavedName(name)) return false;
+  let removed = false;
+  for (const path of [savedPath(name, cwd), userSavedPath(name)]) {
+    if (!existsSync(path)) continue;
+    try {
+      rmSync(path, { force: true });
+      removed = true;
+    } catch {
+      // Keep trying the other scope; report whether anything was removed.
+    }
+  }
+  return removed;
+}

package/src/shared-store.ts

@@ -0,0 +1,132 @@
+/**
+ * shared-store.ts — in-memory key-value store scoped to a single workflow run.
+ *
+ * One `SharedStore` instance is created at run start and disposed when the run
+ * ends. Two MCP-compatible tool definitions (`store_put` / `store_get`) are
+ * injected into every agent's tool list so parallel agents can share
+ * intermediate state without coordinating through the script itself.
+ *
+ * Journal integration: the runtime captures `store.commitDelta(deltaKey)`
+ * alongside each agent result in the journal. On resume,
+ * `store.applyDelta(delta)` rebuilds the store state additively in callSeq
+ * order, so parallel-agent writes are replayed correctly without the
+ * last-complete-wins ordering bug that a whole-Map restore() would cause.
+ *
+ * `deltaKey` must be unique across every run that shares this store instance,
+ * not just within one run's callSeq. A nested `workflow()` call restarts its
+ * own callSeq at 0 while inheriting the parent's store, so a bare callIndex
+ * would collide. Callers compose `deltaKey` as `${runId}:${callIndex}`.
+ */
+
+export class SharedStore {
+  private readonly map = new Map<string, unknown>();
+  // Per-agent write deltas; keyed by a run-unique `${runId}:${callIndex}` string.
+  private readonly agentDeltas = new Map<string, Record<string, unknown>>();
+  // Pre-write shadow values for the CURRENT delta-key's in-progress writes, so a
+  // failed retry attempt's mutations can be rolled back (see `discardDelta`)
+  // instead of leaking into the live store or a later successful attempt's
+  // recorded delta. Populated lazily on first write to a given key within the
+  // current delta window; cleared whenever the delta is finalized either way.
+  private readonly priorValues = new Map<string, Map<string, { existed: boolean; value: unknown }>>();
+
+  /** Store a value under `key`. Overwrites any existing value. */
+  put(key: string, value: unknown): void {
+    this.map.set(key, value);
+  }
+
+  /** Store a value and record the write in the per-agent delta for `deltaKey`. */
+  trackPut(key: string, value: unknown, deltaKey: string): void {
+    let priors = this.priorValues.get(deltaKey);
+    if (!priors) {
+      priors = new Map();
+      this.priorValues.set(deltaKey, priors);
+    }
+    // Only shadow the value from BEFORE this delta window started writing to
+    // this key — a second write within the same attempt must not overwrite the
+    // shadow with its own (already-in-window) value.
+    if (!priors.has(key)) {
+      priors.set(
+        key,
+        this.map.has(key) ? { existed: true, value: this.map.get(key) } : { existed: false, value: undefined },
+      );
+    }
+    this.map.set(key, value);
+    let delta = this.agentDeltas.get(deltaKey);
+    if (!delta) {
+      delta = {};
+      this.agentDeltas.set(deltaKey, delta);
+    }
+    delta[key] = value;
+  }
+
+  /** Retrieve the value for `key`, or `undefined` when absent. */
+  get(key: string): unknown {
+    return this.map.get(key);
+  }
+
+  /** Whether `key` is present in the store. */
+  has(key: string): boolean {
+    return this.map.has(key);
+  }
+
+  /** Return a deep-copied plain-object snapshot of all entries. */
+  snapshot(): Record<string, unknown> {
+    return structuredClone(Object.fromEntries(this.map));
+  }
+
+  /**
+   * Extract and clear the write delta accumulated for `deltaKey`.
+   * Called after an agent completes to get the set of keys it wrote.
+   */
+  commitDelta(deltaKey: string): Record<string, unknown> {
+    const delta = this.agentDeltas.get(deltaKey) ?? {};
+    this.agentDeltas.delete(deltaKey);
+    this.priorValues.delete(deltaKey);
+    return delta;
+  }
+
+  /**
+   * Undo the writes recorded for `deltaKey` and discard its bookkeeping,
+   * without touching any other key. Used when a retry attempt fails: that
+   * attempt's writes must not remain visible in the live store nor merge into
+   * the delta eventually recorded by a later successful attempt of the SAME
+   * call. Per-key guard: a key is only rolled back if the store STILL holds
+   * this attempt's own last write to it (`Object.is`); a concurrent sibling's
+   * overwrite is left untouched.
+   */
+  discardDelta(deltaKey: string): void {
+    const delta = this.agentDeltas.get(deltaKey);
+    if (!delta) return;
+    const priors = this.priorValues.get(deltaKey);
+    for (const key of Object.keys(delta)) {
+      if (!Object.is(this.map.get(key), delta[key])) continue;
+      const prior = priors?.get(key);
+      if (prior?.existed) this.map.set(key, prior.value);
+      else this.map.delete(key);
+    }
+    this.agentDeltas.delete(deltaKey);
+    this.priorValues.delete(deltaKey);
+  }
+
+  /** Apply a write delta additively — sets each key without clearing others. */
+  applyDelta(delta: Record<string, unknown>): void {
+    for (const [k, v] of Object.entries(delta)) {
+      this.map.set(k, v);
+    }
+  }
+
+  /** Replace all entries with a snapshot (full reset). */
+  restore(snap: Record<string, unknown>): void {
+    this.map.clear();
+    for (const [k, v] of Object.entries(snap)) {
+      this.map.set(k, v);
+    }
+  }
+
+  /** Clear all entries (called when the run ends). */
+  dispose(): void {
+    this.map.clear();
+    this.agentDeltas.clear();
+    this.priorValues.clear();
+  }
+}

package/src/ui.ts

@@ -1,9 +1,9 @@
 import type { ExtensionCommandContext, Theme } from "@earendil-works/pi-coding-agent";
 import { DynamicBorder } from "@earendil-works/pi-coding-agent";
 import { Container, type SelectItem, SelectList, Text } from "@earendil-works/pi-tui";
-import type { WorkflowEngine, WorkflowSummary } from "./engine.js";
+import type { WorkflowEngine } from "./engine.js";
+import type { ScriptRun } from "./journal.js";
 import { sanitizeDisplayText } from "./safe-text.js";
-import { isTerminalWorkflow, type WorkflowStatus } from "./state-machine.js";
 
 /** Bounds, in code points, for untrusted strings rendered into the navigator. */
 const MAX_NAME_CHARS = 200;
@@ -12,6 +12,38 @@ const MAX_RESULT_CHARS = 300;
 const MAX_RUN_ERROR_CHARS = 500;
 const MAX_DESCRIPTION_CHARS = 120;
 
+/**
+ * Pure snapshot render layer shared by the navigator, the live widget, and any
+ * inline render site. All child-agent output passes through sanitizeDisplayText
+ * BEFORE truncation so a live escape introducer is never cut mid-sequence.
+ */
+export function snapshotRunLine(run: ScriptRun): string {
+  return formatWorkflowRunLabel(run);
+}
+
+/** Live-widget lines for all non-terminal runs (A10). */
+export function liveWidgetLines(
+  runs: readonly ScriptRun[],
+  mode: "compact" | "detailed" = "compact",
+  maxAgentsShown = 6,
+): string[] {
+  const active = runs.filter((run) => !isTerminal(run.status));
+  if (active.length === 0) return [];
+  const boundedMax = Math.max(1, Math.min(32, Math.floor(maxAgentsShown)));
+  const lines = ["Workflows"];
+  for (const run of active.slice(0, boundedMax)) {
+    lines.push(`  ${snapshotRunLine(run)}`);
+    if (mode === "detailed") {
+      for (const [nodeId, status] of Object.entries(run.callStatus).slice(0, boundedMax)) {
+        lines.push(`    ${nodeId}: ${status}`);
+      }
+    }
+  }
+  return lines.slice(0, 1 + boundedMax * (mode === "detailed" ? boundedMax + 1 : 1));
+}
+
+export type RunStatus = ScriptRun["status"];
+
 function elapsed(ms: number): string {
   const seconds = Math.floor(ms / 1_000);
   if (seconds < 60) return `${seconds}s`;
@@ -19,47 +51,51 @@ function elapsed(ms: number): string {
   return `${minutes}m ${seconds % 60}s`;
 }
 
-export function formatWorkflowRunLabel(run: WorkflowSummary): string {
-  const phases = run.phaseCount > 0 ? ` · phases ${run.completedPhases}/${run.phaseCount}` : "";
-  const tokens = run.tokenCount === undefined ? "" : ` · ${run.tokenCount} tokens`;
-  const name = sanitizeDisplayText(run.name, MAX_NAME_CHARS);
-  return `${name} · ${run.status}${phases} · ${run.completedTasks}/${run.taskCount} tasks · ${elapsed(run.elapsedMs)}${tokens}`;
+function isTerminal(status: RunStatus): boolean {
+  return status === "completed" || status === "failed" || status === "stopped";
+}
+
+export function formatWorkflowRunLabel(run: ScriptRun): string {
+  const phases = run.meta.phases && run.meta.phases.length > 0 ? ` · phases ${run.meta.phases.length}` : "";
+  const calls = Object.keys(run.callResults).length;
+  const name = sanitizeDisplayText(run.meta.name, MAX_NAME_CHARS);
+  return `${name} · ${run.status}${phases} · ${calls} calls · ${elapsed(Math.max(0, (isTerminal(run.status) ? run.updatedAt : Date.now()) - run.startedAt))}`;
 }
 
 export function formatWorkflowDetail(engine: WorkflowEngine, runId: string): string {
-  const run = engine.getRun(runId);
-  if (!run) return "Workflow run is no longer available.";
-  const tokenValues = [...Object.values(run.taskResults), ...(run.synthesisResult ? [run.synthesisResult] : [])]
+  const state = engine.getState(runId);
+  if (!state) return "Workflow run is no longer available.";
+  const run = state.run;
+  const tokenValues = Object.values(run.callResults)
     .map((result) => result.tokenCount)
     .filter((value): value is number => value !== undefined);
   const tokenCount = tokenValues.length > 0 ? tokenValues.reduce((total, value) => total + value, 0) : undefined;
   const lines = [
-    `${sanitizeDisplayText(run.definition.name, MAX_NAME_CHARS)} [${run.status}]`,
+    `${sanitizeDisplayText(run.meta.name, MAX_NAME_CHARS)} [${run.status}]`,
     `run: ${sanitizeDisplayText(run.runId, MAX_ID_CHARS)}`,
-    `elapsed: ${elapsed(Math.max(0, (isTerminalWorkflow(run.status) ? run.updatedAt : Date.now()) - run.startedAt))}`,
+    `elapsed: ${elapsed(Math.max(0, (isTerminal(run.status) ? run.updatedAt : Date.now()) - run.startedAt))}`,
     "",
     ...(tokenCount === undefined ? [] : [`tokens: ${tokenCount}`]),
   ];
-  for (const phase of run.definition.phases) {
+  for (const phase of run.meta.phases ?? []) {
     lines.push(`Phase: ${sanitizeDisplayText(phase.title, MAX_NAME_CHARS)}`);
-    for (const task of run.definition.tasks.filter((candidate) => candidate.phase === phase.id)) {
-      const status = run.taskStatus[task.id] ?? "pending";
-      const agent = run.agentIds[task.id] ? ` agent=${sanitizeDisplayText(run.agentIds[task.id], MAX_ID_CHARS)}` : "";
-      const compact = run.compactions[task.id] ? ` compactions=${run.compactions[task.id]}` : "";
-      lines.push(`  ${status.padEnd(11)} ${sanitizeDisplayText(task.id, MAX_ID_CHARS)}${agent}${compact}`);
-      const result = run.taskResults[task.id];
-      if (result?.error) lines.push(`    error: ${sanitizeDisplayText(result.error, MAX_RESULT_CHARS)}`);
-      if (result?.text) lines.push(`    result: ${sanitizeDisplayText(result.text, MAX_RESULT_CHARS)}`);
-    }
   }
-  const unphased = run.definition.tasks.filter((task) => task.phase === undefined);
-  if (unphased.length > 0) {
-    lines.push("Tasks:");
-    for (const task of unphased) {
-      const status = run.taskStatus[task.id] ?? "pending";
-      const agent = run.agentIds[task.id] ? ` agent=${sanitizeDisplayText(run.agentIds[task.id], MAX_ID_CHARS)}` : "";
-      lines.push(`  ${status.padEnd(11)} ${sanitizeDisplayText(task.id, MAX_ID_CHARS)}${agent}`);
-    }
+  const calls = Object.entries(run.callStatus)
+    .sort(([a], [b]) => Number(a) - Number(b))
+    .map(([nodeId, status]) => {
+      const result = run.callResults[nodeId];
+      const agent = run.agentIds[nodeId] ? ` agent=${sanitizeDisplayText(run.agentIds[nodeId], MAX_ID_CHARS)}` : "";
+      const compact = run.compactions[nodeId] ? ` compactions=${run.compactions[nodeId]}` : "";
+      const parts = [`  ${status.padEnd(11)} call ${sanitizeDisplayText(nodeId, MAX_ID_CHARS)}${agent}${compact}`];
+      if (result?.error) parts.push(`    error: ${sanitizeDisplayText(result.error, MAX_RESULT_CHARS)}`);
+      if (result?.result !== undefined && result.status === "completed") {
+        parts.push(`    result: ${sanitizeDisplayText(String(result.result), MAX_RESULT_CHARS)}`);
+      }
+      return parts.join("\n");
+    });
+  if (calls.length > 0) {
+    lines.push("Calls:");
+    lines.push(...calls);
   }
   lines.push("", "Live agent conversations remain available through pi-subagents FleetView.");
   if (run.error) lines.push(`Error: ${sanitizeDisplayText(run.error, MAX_RUN_ERROR_CHARS)}`);
@@ -81,15 +117,12 @@ const STOP: WorkflowActionItem = { value: "stop", label: "Stop" };
 const BACK: WorkflowActionItem = { value: "back", label: "Back" };
 
 /**
- * Menu actions legal for a run in `status`, mirroring what `WorkflowEngine.control` accepts.
- * Exhaustive by construction: there is no `default` arm, so adding a `WorkflowStatus` member
- * is a compile error here instead of a silently wrong menu.
+ * Menu actions legal for a run in `status`. Exhaustive by construction.
  */
-export function workflowActionsFor(status: WorkflowStatus): readonly WorkflowActionItem[] {
+export function workflowActionsFor(status: RunStatus): readonly WorkflowActionItem[] {
   switch (status) {
     case "pending":
     case "pausing":
-    case "synthesizing":
     case "stopping":
       return [REFRESH, STOP, BACK];
     case "running":
@@ -145,25 +178,29 @@ export async function showWorkflowNavigator(ctx: ExtensionCommandContext, engine
     return;
   }
   while (true) {
-    const runs = engine.list();
+    const states = engine
+      .list()
+      .map((summary) => engine.getRun(String(summary.runId)))
+      .filter((run): run is ScriptRun => run !== undefined)
+      .sort((a, b) => b.startedAt - a.startedAt);
     const selected = await selectList<string>(
       ctx,
       "Workflow runs",
-      runs.map((run) => ({
+      states.map((run) => ({
         value: run.runId,
         label: formatWorkflowRunLabel(run),
         description: run.error === undefined ? undefined : sanitizeDisplayText(run.error, MAX_DESCRIPTION_CHARS),
       })),
       (theme) =>
-        runs.length > 0
+        states.length > 0
           ? theme.fg("dim", "Select a run to inspect.")
           : theme.fg("muted", "No workflow runs in this session."),
     );
     if (!selected) return;
     while (true) {
-      const run = engine.get(selected);
+      const run = engine.getRun(selected);
       if (!run) break;
-      const name = sanitizeDisplayText(run.name, MAX_NAME_CHARS);
+      const name = sanitizeDisplayText(run.meta.name, MAX_NAME_CHARS);
       const action = await selectList<WorkflowAction>(
         ctx,
         `${name} · ${run.status}`,

package/src/workflow-settings.ts

@@ -0,0 +1,100 @@
+/** Small, package-owned workflow presentation settings. */
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { basename, join, resolve } from "node:path";
+import { getAgentDir } from "@earendil-works/pi-coding-agent";
+
+export type WorkflowProgressMode = "compact" | "detailed";
+
+export interface WorkflowSettings {
+  progressMode?: WorkflowProgressMode;
+  maxAgentsShown?: number;
+  effort?: "off" | "high" | "ultra";
+  keywordTriggerWord?: string;
+  keywordTriggerEnabled?: boolean;
+}
+
+const DEFAULT_SETTINGS: Required<
+  Pick<WorkflowSettings, "progressMode" | "maxAgentsShown" | "effort" | "keywordTriggerEnabled">
+> = {
+  progressMode: "compact",
+  maxAgentsShown: 6,
+  effort: "off",
+  keywordTriggerEnabled: true,
+};
+
+function projectDirectory(cwd: string): string {
+  const absolute = resolve(cwd);
+  const digest = createHash("sha256").update(absolute).digest("hex").slice(0, 12);
+  return join(getAgentDir(), "workflows", "projects", `${basename(absolute) || "root"}-${digest}`);
+}
+
+function readSettings(path: string): WorkflowSettings {
+  if (!existsSync(path)) return {};
+  try {
+    const parsed: unknown = JSON.parse(readFileSync(path, "utf8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
+    const value = parsed as Record<string, unknown>;
+    return {
+      ...(value.progressMode === "compact" || value.progressMode === "detailed"
+        ? { progressMode: value.progressMode }
+        : {}),
+      ...(typeof value.maxAgentsShown === "number" &&
+      Number.isInteger(value.maxAgentsShown) &&
+      value.maxAgentsShown >= 1 &&
+      value.maxAgentsShown <= 32
+        ? { maxAgentsShown: value.maxAgentsShown }
+        : {}),
+      ...(value.effort === "off" || value.effort === "high" || value.effort === "ultra"
+        ? { effort: value.effort }
+        : {}),
+      ...(typeof value.keywordTriggerWord === "string" &&
+      /^[A-Za-z][A-Za-z0-9_-]{0,31}$/u.test(value.keywordTriggerWord)
+        ? { keywordTriggerWord: value.keywordTriggerWord.toLowerCase() }
+        : {}),
+      ...(typeof value.keywordTriggerEnabled === "boolean"
+        ? { keywordTriggerEnabled: value.keywordTriggerEnabled }
+        : {}),
+    };
+  } catch {
+    return {};
+  }
+}
+
+export function loadWorkflowSettings(
+  cwd: string = process.cwd(),
+): WorkflowSettings & Required<Pick<WorkflowSettings, "progressMode" | "maxAgentsShown" | "effort">> {
+  const globalPath = join(getAgentDir(), "workflows", "settings.json");
+  const projectPath = join(projectDirectory(cwd), "settings.json");
+  return { ...DEFAULT_SETTINGS, ...readSettings(globalPath), ...readSettings(projectPath) };
+}
+
+export function saveWorkflowSettings(settings: WorkflowSettings, cwd: string = process.cwd()): void {
+  const safe: WorkflowSettings = {
+    ...(settings.progressMode === "compact" || settings.progressMode === "detailed"
+      ? { progressMode: settings.progressMode }
+      : {}),
+    ...(typeof settings.maxAgentsShown === "number" &&
+    Number.isInteger(settings.maxAgentsShown) &&
+    settings.maxAgentsShown >= 1 &&
+    settings.maxAgentsShown <= 32
+      ? { maxAgentsShown: settings.maxAgentsShown }
+      : {}),
+    ...(settings.effort === "off" || settings.effort === "high" || settings.effort === "ultra"
+      ? { effort: settings.effort }
+      : {}),
+    ...(typeof settings.keywordTriggerWord === "string" &&
+    /^[A-Za-z][A-Za-z0-9_-]{0,31}$/u.test(settings.keywordTriggerWord)
+      ? { keywordTriggerWord: settings.keywordTriggerWord.toLowerCase() }
+      : {}),
+    ...(typeof settings.keywordTriggerEnabled === "boolean"
+      ? { keywordTriggerEnabled: settings.keywordTriggerEnabled }
+      : {}),
+  };
+  const directory = projectDirectory(cwd);
+  mkdirSync(directory, { recursive: true });
+  const path = join(directory, "settings.json");
+  const temporary = `${path}.${process.pid}.${Date.now().toString(36)}.tmp`;
+  writeFileSync(temporary, `${JSON.stringify(safe, null, 2)}\n`, { encoding: "utf8", flag: "wx" });
+  renameSync(temporary, path);
+}