abelworkflow 1.1.3 → 1.2.0

package/lib/cli/main.mjs

@@ -5,15 +5,15 @@ import c from "picocolors";
 import { assertInteractiveMenuSupported, parseArgs } from "./args.mjs";
 import * as promptApi from "./prompts.mjs";
 import {
-  ensurePiResourcesLinked,
+  ensurePiExtensionsPresent,
   ensureSkillPresent,
-  installManagedWorkflow,
+  installWorkflow,
   packageVersionFor
 } from "../installer/install.mjs";
+import { withDeploymentLock } from "../installer/lock.mjs";
 import {
   finalizeProviderInstallMetadata,
   getPreviousManagedCodexAgentFiles,
-  getPreviousManagedCodexAuthKeys,
   readInstallMetadata,
   writeInstallMetadata
 } from "../installer/state.mjs";
@@ -89,22 +89,33 @@ function presentInstallReport(report, reportOutput) {
   }
 }
 
+function assertNoInstallConflicts(report) {
+  if (uniqueReportPaths(report.conflicts).length > 0) {
+    throw new Error("工作流安装存在冲突");
+  }
+}
+
 async function runManagedInstall(options) {
-  const report = await installManagedWorkflow(options);
+  const report = await installWorkflow(options);
   presentInstallReport(report, p.log);
+  assertNoInstallConflicts(report);
   return report;
 }
 
-async function ensureSkillPresentWithReport(paths, skillName) {
-  const report = await ensureSkillPresent(paths, skillName);
-  presentInstallReport(report, p.log);
-  return report;
+async function ensureSkillPresentWithReport(paths, skillName, continuation) {
+  return ensureSkillPresent(paths, skillName, async (report, guard) => {
+    presentInstallReport(report, p.log);
+    assertNoInstallConflicts(report);
+    return continuation ? continuation(guard) : report;
+  });
 }
 
-async function ensurePiResourcesLinkedWithReport(paths) {
-  const report = await ensurePiResourcesLinked(paths);
-  presentInstallReport(report, p.log);
-  return report;
+async function ensurePiExtensionsPresentWithReport(paths, continuation) {
+  return ensurePiExtensionsPresent(paths, async (report, guard) => {
+    presentInstallReport(report, p.log);
+    assertNoInstallConflicts(report);
+    return continuation ? continuation(guard) : report;
+  });
 }
 
 function printHelp() {
@@ -115,83 +126,104 @@ ${c.bold("Usage:")}
   ${c.cyan("npx abelworkflow init")}
   ${c.cyan("npx abelworkflow install")}
   ${c.cyan("npx abelworkflow install --force")}
-  ${c.cyan("npx abelworkflow install --link-only")}
   ${c.cyan("npx abelworkflow install --agents-dir /custom/path")}
-  ${c.cyan("npx abelworkflow --non-interactive")}
 
 ${c.bold("Default behavior:")}
   - npx abelworkflow: open the interactive setup menu.
   - npx abelworkflow install: sync managed files and links explicitly.
-  - --non-interactive: auto-execute install (skip interactive menu); auto-enabled in CI.
 `);
 }
 
 async function configureProviderWithMetadata(paths, configure) {
-  const metadata = await readInstallMetadata(paths);
-  const packageVersion = await packageVersionFor(paths, metadata);
-  const overrides = await configure(metadata);
-  await writeInstallMetadata(paths, finalizeProviderInstallMetadata({
-    previousMetadata: metadata,
-    packageVersion,
-    overrides
-  }));
+  return withDeploymentLock(paths, async (guard) => {
+    await guard();
+    const metadata = await readInstallMetadata(paths);
+    const packageVersion = await packageVersionFor(paths, metadata);
+    const overrides = await configure(metadata, guard);
+    await writeInstallMetadata(paths, finalizeProviderInstallMetadata({
+      previousMetadata: metadata,
+      packageVersion,
+      overrides
+    }), { guard });
+  });
 }
 
 async function configureCodexForPaths(paths) {
-  await configureProviderWithMetadata(paths, async (metadata) => {
+  await configureProviderWithMetadata(paths, async (metadata, guard) => {
     const result = await configureCodexApi(paths, promptApi, {
-      managedAuthKeys: getPreviousManagedCodexAuthKeys(metadata),
+      guard,
       managedCodexAgentFiles: getPreviousManagedCodexAgentFiles(metadata)
     });
     return {
-      managedCodexAuthKeys: result.managedAuthKeys,
       managedCodexAgentFiles: result.managedCodexAgentFiles
     };
   });
 }
 
 async function configureClaudeForPaths(paths) {
-  await configureProviderWithMetadata(paths, () => configureClaudeApi(paths, promptApi));
+  await configureClaudeApi(paths, promptApi);
 }
 
-async function runFullInit(options) {
-  const installReport = await runManagedInstall({
-    paths: options.paths,
-    force: options.force,
-    relinkOnly: false
-  });
+async function runFullInit(options, runtime = {}) {
+  const operations = {
+    installWorkflow: () => runManagedInstall({
+      paths: options.paths,
+      force: options.force
+    }),
+    confirm: confirmOrCancel,
+    commandExists,
+    installClaude: () => installCliTool("claude", promptApi),
+    configureClaude: () => configureClaudeForPaths(options.paths),
+    installCodex: () => installCliTool("codex", promptApi),
+    configureCodex: () => configureCodexForPaths(options.paths),
+    installPi: () => installCliTool("pi", promptApi),
+    configurePi: () => configurePiApi(
+      options.paths,
+      ensurePiExtensionsPresentWithReport,
+      promptApi
+    ),
+    configureGrok: () => configureGrokSearchEnv(
+      options.paths,
+      (paths, continuation) => ensureSkillPresentWithReport(paths, "grok-search", continuation),
+      promptApi
+    ),
+    configureContext7: () => configureContext7Env(
+      options.paths,
+      (paths, continuation) => ensureSkillPresentWithReport(paths, "context7-auto-research", continuation),
+      promptApi
+    ),
+    success: (message) => p.log.success(message),
+    ...runtime
+  };
 
-  if (await confirmOrCancel({ message: "是否安装或更新 Claude Code CLI？", initialValue: false })) {
-    await installCliTool("claude", promptApi);
+  await operations.installWorkflow();
+
+  if (await operations.confirm({ message: "是否安装或更新 Claude Code CLI？", initialValue: false })) {
+    await operations.installClaude();
   }
-  if (await confirmOrCancel({ message: "是否配置 Claude Code 第三方 API？", initialValue: commandExists("claude") })) {
-    await configureClaudeForPaths(options.paths);
+  if (await operations.confirm({ message: "是否配置 Claude Code 第三方 API？", initialValue: operations.commandExists("claude") })) {
+    await operations.configureClaude();
   }
-  if (await confirmOrCancel({ message: "是否安装或更新 Codex CLI？", initialValue: false })) {
-    await installCliTool("codex", promptApi);
+  if (await operations.confirm({ message: "是否安装或更新 Codex CLI？", initialValue: false })) {
+    await operations.installCodex();
   }
-  if (await confirmOrCancel({ message: "是否配置 Codex 第三方 API？", initialValue: commandExists("codex") })) {
-    await configureCodexForPaths(options.paths);
+  if (await operations.confirm({ message: "是否配置 Codex 第三方 API？", initialValue: operations.commandExists("codex") })) {
+    await operations.configureCodex();
   }
-  if (await confirmOrCancel({ message: "是否安装或更新 Pi CLI？", initialValue: false })) {
-    await installCliTool("pi", promptApi);
+  if (await operations.confirm({ message: "是否安装或更新 Pi CLI？", initialValue: false })) {
+    await operations.installPi();
   }
-  if (await confirmOrCancel({ message: "是否配置 Pi 当前有效 Provider API？", initialValue: commandExists("pi") })) {
-    await configurePiApi(options.paths, ensurePiResourcesLinkedWithReport, promptApi);
+  if (await operations.confirm({ message: "是否配置 Pi 当前有效 Provider API？", initialValue: operations.commandExists("pi") })) {
+    await operations.configurePi();
   }
-  if (await confirmOrCancel({ message: "是否填写 grok-search 环境变量？", initialValue: false })) {
-    await configureGrokSearchEnv(options.paths, (paths) => ensureSkillPresentWithReport(paths, "grok-search"), promptApi);
+  if (await operations.confirm({ message: "是否填写 grok-search 环境变量？", initialValue: false })) {
+    await operations.configureGrok();
   }
-  if (await confirmOrCancel({ message: "是否填写 context7-auto-research 环境变量？", initialValue: false })) {
-    await configureContext7Env(options.paths, (paths) => ensureSkillPresentWithReport(paths, "context7-auto-research"), promptApi);
+  if (await operations.confirm({ message: "是否填写 context7-auto-research 环境变量？", initialValue: false })) {
+    await operations.configureContext7();
   }
 
-  const conflictCount = uniqueReportPaths(installReport.conflicts).length;
-  if (conflictCount > 0) {
-    p.log.warn(c.yellow(`AbelWorkflow 初始化流程结束；已保留 ${conflictCount} 个工作流冲突`));
-  } else {
-    p.log.success(c.green("AbelWorkflow 完整初始化完成"));
-  }
+  operations.success(c.green("AbelWorkflow 完整初始化完成"));
 }
 
 async function runInteractiveMenu(options) {
@@ -209,7 +241,11 @@ async function runInteractiveMenu(options) {
     pi: {
       title: "Pi",
       install: () => installCliTool("pi", promptApi),
-      configure: () => configurePiApi(options.paths, ensurePiResourcesLinkedWithReport, promptApi)
+      configure: () => configurePiApi(
+        options.paths,
+        ensurePiExtensionsPresentWithReport,
+        promptApi
+      )
     },
     codex: {
       title: "Codex",
@@ -251,11 +287,10 @@ async function runInteractiveMenu(options) {
     "full-init": async () => runFullInit(options),
     install: async () => runManagedInstall({
       paths: options.paths,
-      force: options.force,
-      relinkOnly: options.relinkOnly
+      force: options.force
     }),
-    "grok-search": async () => configureGrokSearchEnv(options.paths, (paths) => ensureSkillPresentWithReport(paths, "grok-search"), promptApi),
-    context7: async () => configureContext7Env(options.paths, (paths) => ensureSkillPresentWithReport(paths, "context7-auto-research"), promptApi),
+    "grok-search": async () => configureGrokSearchEnv(options.paths, (paths, continuation) => ensureSkillPresentWithReport(paths, "grok-search", continuation), promptApi),
+    context7: async () => configureContext7Env(options.paths, (paths, continuation) => ensureSkillPresentWithReport(paths, "context7-auto-research", continuation), promptApi),
     "pi-cli": async () => runCliToolMenu("pi"),
     "codex-cli": async () => runCliToolMenu("codex"),
     "claude-cli": async () => runCliToolMenu("claude")
@@ -324,11 +359,6 @@ async function main(argv, runtime = {}) {
     return 0;
   }
 
-  if (options.command === "menu" && options.nonInteractive) {
-    console.log("检测到非交互模式，自动执行工作流安装...");
-    options.command = "install";
-  }
-
   if (options.command === "install") {
     try {
       await runManagedInstall({
@@ -341,8 +371,7 @@ async function main(argv, runtime = {}) {
       });
     } catch (error) {
       const message = `操作失败: ${error.message || String(error)}`;
-      if (options.nonInteractive) console.error(message);
-      else p.outro(c.red(message));
+      p.outro(c.red(message));
       return 1;
     }
     return 0;
@@ -351,8 +380,7 @@ async function main(argv, runtime = {}) {
   assertInteractiveMenuSupported({
     command: options.command,
     inputIsTTY: runtime.inputIsTTY ?? input.isTTY,
-    outputIsTTY: runtime.outputIsTTY ?? output.isTTY,
-    nonInteractive: options.nonInteractive
+    outputIsTTY: runtime.outputIsTTY ?? output.isTTY
   });
 
   try {
@@ -367,10 +395,15 @@ async function main(argv, runtime = {}) {
     return 0;
   } catch (error) {
     const message = `操作失败: ${error.message || String(error)}`;
-    if (options.nonInteractive) console.error(message);
-    else p.outro(c.red(message));
+    p.outro(c.red(message));
     return 1;
   }
 }
 
-export { main, presentInstallReport };
+export {
+  assertNoInstallConflicts,
+  configureProviderWithMetadata,
+  main,
+  presentInstallReport,
+  runFullInit
+};

package/lib/cli/prompts.mjs

@@ -40,8 +40,12 @@ function required(message = "此项不能为空") {
 }
 
 function requiredUnlessExisting(existingValue, message = "此项不能为空") {
+  const configured = typeof existingValue === "string" && existingValue.trim() !== "";
   return (value) => {
-    if ((value === undefined || value === null || (typeof value === "string" && value.trim() === "")) && !existingValue) return message;
+    const trimmed = typeof value === "string" ? value.trim() : value;
+    if (trimmed === "-" || ((trimmed === undefined || trimmed === null || trimmed === "") && !configured)) {
+      return message;
+    }
   };
 }
 
@@ -60,8 +64,11 @@ function resolvePasswordValue(userInput, existingValue) {
 
 function passwordPromptOptions(message, existingValue, validate) {
   const configured = typeof existingValue === "string" && existingValue.trim() !== "";
+  const hint = configured
+    ? `（已配置，直接回车保留${validate ? "" : "；输入 - 清除"}）`
+    : validate ? "" : "（输入 - 清除）";
   return {
-    message: `${message}${configured ? "（已配置，直接回车保留；输入 - 清除）" : "（输入 - 清除）"}`,
+    message: `${message}${hint}`,
     mask: "*",
     ...(validate ? { validate } : {})
   };

package/lib/config/dotenv.mjs

@@ -91,4 +91,4 @@ function updateDotenvContent(content, updates) {
   return next;
 }
 
-export { parseDotenv, quoteEnvValue, updateDotenvContent };
+export { parseDotenv, updateDotenvContent };

package/lib/config/jsonc.mjs

@@ -77,4 +77,4 @@ function stripJsonTrailingCommas(content) {
   return output;
 }
 
-export { stripJsonComments, stripJsonTrailingCommas };
+export { stripJsonComments };

package/lib/config/store.mjs

@@ -1,5 +1,5 @@
 import * as fs from "node:fs/promises";
-import { dirname, join } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import lockfile from "proper-lockfile";
 import { parseDotenv, updateDotenvContent } from "./dotenv.mjs";
 import { stripJsonComments } from "./jsonc.mjs";
@@ -21,6 +21,51 @@ function isPosix() {
   return process.platform !== "win32";
 }
 
+function assertPlainObject(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new TypeError(`${label} must contain a JSON object`);
+  }
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== null && prototype !== Object.prototype) {
+    throw new TypeError(`${label} must contain a JSON object`);
+  }
+  return value;
+}
+
+async function assertSafeFilePath(path, safeRoot) {
+  if (!safeRoot) return;
+  const root = resolve(safeRoot);
+  const target = resolve(path);
+  const relativePath = relative(root, target);
+  if (!relativePath || relativePath === ".." || relativePath.startsWith(`..${sep}`) || isAbsolute(relativePath)) {
+    throw new Error(`Unsafe config path outside root: ${path}`);
+  }
+
+  const segments = relativePath.split(sep);
+  let current = root;
+  for (const segment of segments.slice(0, -1)) {
+    current = join(current, segment);
+    try {
+      const currentStat = await fs.lstat(current);
+      if (currentStat.isSymbolicLink() || !currentStat.isDirectory()) {
+        throw new Error(`Unsafe config parent: ${current}`);
+      }
+    } catch (error) {
+      if (isMissing(error)) break;
+      throw error;
+    }
+  }
+
+  try {
+    const targetStat = await fs.lstat(target);
+    if (targetStat.isSymbolicLink() || !targetStat.isFile()) {
+      throw new Error(`Unsafe config file: ${target}`);
+    }
+  } catch (error) {
+    if (!isMissing(error)) throw error;
+  }
+}
+
 async function pathExists(path) {
   try {
     await fs.lstat(path);
@@ -52,8 +97,14 @@ async function repairSensitiveMode(path) {
   return true;
 }
 
-async function readFileWithOptions(path, { fallback, sensitive = false, hasFallback = true } = {}) {
+async function readFileWithOptions(path, {
+  fallback,
+  sensitive = false,
+  hasFallback = true,
+  safeRoot
+} = {}) {
   try {
+    await assertSafeFilePath(path, safeRoot);
     if (sensitive) await assertSensitiveRegularIfPresent(path);
     const content = await fs.readFile(path, "utf8");
     if (sensitive) await repairSensitiveMode(path);
@@ -87,7 +138,8 @@ function parseJsonAtPath(path, content, jsonc = false) {
 async function readJsonFileSafe(path, fallback = {}, options = {}) {
   const content = await readFileWithOptions(path, {
     fallback: null,
-    sensitive: options.sensitive
+    sensitive: options.sensitive,
+    safeRoot: options.safeRoot
   });
   return content === null ? fallback : parseJsonAtPath(path, content);
 }
@@ -95,17 +147,10 @@ async function readJsonFileSafe(path, fallback = {}, options = {}) {
 async function readJsoncFileSafe(path, fallback = {}, options = {}) {
   const content = await readFileWithOptions(path, {
     fallback: null,
-    sensitive: options.sensitive
-  });
-  return content === null ? fallback : parseJsonAtPath(path, content, true);
-}
-
-async function readText(path, options = {}) {
-  return readFileWithOptions(path, {
-    fallback: options.fallback,
     sensitive: options.sensitive,
-    hasFallback: Object.hasOwn(options, "fallback")
+    safeRoot: options.safeRoot
   });
+  return content === null ? fallback : parseJsonAtPath(path, content, true);
 }
 
 async function listNewBackups(targetPath) {
@@ -165,6 +210,7 @@ async function writeText(path, content, options = {}) {
   let exists = true;
   let permissionRepaired = false;
 
+  await assertSafeFilePath(path, options.safeRoot);
   if (sensitive) await assertSensitiveRegularIfPresent(path);
   try {
     previous = await fs.readFile(path);
@@ -203,27 +249,145 @@ async function writeText(path, content, options = {}) {
   }
 }
 
-async function writeJson(path, value, options = {}) {
-  await readJsonFileSafe(path, {}, options);
-  return writeText(path, `${JSON.stringify(value, null, 2)}\n`, options);
+async function snapshotFile(path, options) {
+  await assertSafeFilePath(path, options.safeRoot);
+  try {
+    const targetStat = await fs.lstat(path);
+    if (targetStat.isSymbolicLink() || !targetStat.isFile()) {
+      throw new Error(`Unsafe config file: ${path}`);
+    }
+    return {
+      content: await fs.readFile(path),
+      exists: true,
+      mode: targetStat.mode & 0o777
+    };
+  } catch (error) {
+    if (isMissing(error)) return { content: null, exists: false, mode: undefined };
+    throw error;
+  }
 }
 
-async function updateLockedJson(path, updater, options = {}) {
-  await fs.mkdir(dirname(path), { recursive: true, mode: options.sensitive ? 0o700 : 0o777 });
-  const release = await lockfile.lock(path, {
-    realpath: false,
-    retries: options.retries ?? 2,
-    lockfilePath: `${path}.lock`
-  });
+async function restoreSnapshot(path, snapshot, options) {
+  await assertSafeFilePath(path, options.safeRoot);
+  if (!snapshot.exists) {
+    try {
+      const current = await fs.lstat(path);
+      if (current.isSymbolicLink() || !current.isFile()) {
+        throw new Error(`Unsafe config file during rollback: ${path}`);
+      }
+      await fs.unlink(path);
+    } catch (error) {
+      if (!isMissing(error)) throw error;
+    }
+    return;
+  }
+
+  const tempPath = join(dirname(path), `.${path.slice(dirname(path).length + 1)}.abelworkflow.rollback.${nextUniqueSuffix()}`);
+  try {
+    await fs.writeFile(tempPath, snapshot.content, { flag: "wx", mode: snapshot.mode });
+    if (isPosix()) await fs.chmod(tempPath, snapshot.mode);
+    await fs.rename(tempPath, path);
+    if (isPosix()) await fs.chmod(path, snapshot.mode);
+  } catch (error) {
+    await fs.rm(tempPath, { force: true }).catch(() => {});
+    throw error;
+  }
+}
+
+async function withFileTransaction(files, action) {
+  const descriptors = [...files]
+    .map((file) => ({ ...file, path: resolve(file.path) }))
+    .sort((left, right) => left.path.localeCompare(right.path));
+  if (new Set(descriptors.map(({ path }) => path)).size !== descriptors.length) {
+    throw new Error("Transaction paths must be unique");
+  }
+
+  const releases = [];
+  const snapshots = new Map();
+  const touched = new Set();
   try {
-    const current = await readJsonFileSafe(path, options.defaultValue ?? {}, options);
-    const updated = await updater(current);
-    return await writeJson(path, updated, options);
+    for (const descriptor of descriptors) {
+      await assertSafeFilePath(descriptor.path, descriptor.safeRoot);
+      await fs.mkdir(dirname(descriptor.path), {
+        recursive: true,
+        mode: descriptor.sensitive ? 0o700 : 0o777
+      });
+      await assertSafeFilePath(descriptor.path, descriptor.safeRoot);
+      releases.push(await lockfile.lock(descriptor.path, {
+        realpath: false,
+        retries: descriptor.retries ?? {
+          retries: 10,
+          factor: 2,
+          minTimeout: 25,
+          maxTimeout: 1000,
+          randomize: true
+        },
+        lockfilePath: `${descriptor.path}.lock`
+      }));
+    }
+    for (const descriptor of descriptors) {
+      snapshots.set(descriptor.path, await snapshotFile(descriptor.path, descriptor));
+    }
+
+    const descriptorMap = new Map(descriptors.map((descriptor) => [descriptor.path, descriptor]));
+    const transaction = {
+      readJson(path, fallback = {}, { jsonc = false } = {}) {
+        const absolutePath = resolve(path);
+        const snapshot = snapshots.get(absolutePath);
+        if (!snapshot) throw new Error(`Path is not part of transaction: ${path}`);
+        return snapshot.exists
+          ? parseJsonAtPath(absolutePath, snapshot.content.toString("utf8"), jsonc)
+          : fallback;
+      },
+      readText(path, fallback = "") {
+        const snapshot = snapshots.get(resolve(path));
+        if (!snapshot) throw new Error(`Path is not part of transaction: ${path}`);
+        return snapshot.exists ? snapshot.content.toString("utf8") : fallback;
+      },
+      async writeText(path, content, overrides = {}) {
+        const absolutePath = resolve(path);
+        const descriptor = descriptorMap.get(absolutePath);
+        if (!descriptor) throw new Error(`Path is not part of transaction: ${path}`);
+        const { writer = writeText, ...writeOptions } = overrides;
+        touched.add(absolutePath);
+        return writer(absolutePath, content, { ...descriptor, ...writeOptions });
+      },
+      async writeJson(path, value, overrides = {}) {
+        return this.writeText(path, `${JSON.stringify(value, null, 2)}\n`, overrides);
+      }
+    };
+
+    try {
+      return await action(transaction);
+    } catch (error) {
+      const rollbackErrors = [];
+      for (const descriptor of [...descriptors].reverse()) {
+        if (!touched.has(descriptor.path)) continue;
+        try {
+          await restoreSnapshot(descriptor.path, snapshots.get(descriptor.path), descriptor);
+        } catch (rollbackError) {
+          rollbackErrors.push(rollbackError);
+        }
+      }
+      if (rollbackErrors.length) {
+        throw new AggregateError([error, ...rollbackErrors], "Transaction failed and rollback was incomplete", {
+          cause: error
+        });
+      }
+      throw error;
+    }
   } finally {
-    await release();
+    for (const release of releases.reverse()) {
+      await release().catch(() => {});
+    }
   }
 }
 
+async function writeJson(path, value, options = {}) {
+  await readJsonFileSafe(path, {}, options);
+  return writeText(path, `${JSON.stringify(value, null, 2)}\n`, options);
+}
+
 async function backupIfNeeded(targetPath, options = {}) {
   if (!(await pathExists(targetPath))) return null;
   const backupLimit = options.backupLimit ?? 3;
@@ -235,24 +399,11 @@ async function backupIfNeeded(targetPath, options = {}) {
   return backupPath;
 }
 
-async function ensurePrivateJsonFile(path) {
-  await fs.mkdir(dirname(path), { recursive: true, mode: 0o700 });
-  try {
-    await fs.writeFile(path, "{}\n", { encoding: "utf8", flag: "wx", mode: 0o600 });
-    if (isPosix()) await fs.chmod(path, 0o600);
-    return true;
-  } catch (error) {
-    if (error?.code !== "EEXIST") throw error;
-    await assertSensitiveRegularIfPresent(path);
-    await repairSensitiveMode(path);
-    return false;
-  }
-}
-
 async function readDotenvFile(path, options = {}) {
   const content = await readFileWithOptions(path, {
     fallback: "",
-    sensitive: options.sensitive
+    sensitive: options.sensitive,
+    safeRoot: options.safeRoot
   });
   return parseDotenv(content);
 }
@@ -260,22 +411,23 @@ async function readDotenvFile(path, options = {}) {
 async function updateDotenvFile(path, updates, options = {}) {
   const content = await readFileWithOptions(path, {
     fallback: "",
-    sensitive: options.sensitive
+    sensitive: options.sensitive,
+    safeRoot: options.safeRoot
   });
   return writeText(path, updateDotenvContent(content, updates), options);
 }
 
 export {
+  assertPlainObject,
+  assertSafeFilePath,
   backupIfNeeded,
-  ensurePrivateJsonFile,
   pathExists,
   pathTargetExists,
   readDotenvFile,
   readJsonFileSafe,
   readJsoncFileSafe,
-  readText,
   updateDotenvFile,
-  updateLockedJson,
+  withFileTransaction,
   writeJson,
   writeText
 };