agent-takkub 1.0.63 → 1.0.67

package/npm/scripts/pathfix.js

@@ -92,10 +92,29 @@ function posixEnsure(binDir) {
   if (fs.existsSync(bashrc)) rcs.push(bashrc);
   let added = false;
   for (const rc of rcs) {
-    const existing = fs.existsSync(rc) ? fs.readFileSync(rc, 'utf8') : '';
-    if (existing.includes(MARKER)) continue;
-    fs.writeFileSync(rc, existing + block);
-    added = true;
+    // One fd carries the whole check-then-write cycle (not separate
+    // existsSync/readFileSync/writeFileSync path lookups): opening `rc`
+    // once and reusing that fd for both the read and the append means what
+    // we inspected and what we wrote to are provably the same file, with
+    // no window between "check" and "write" for `rc` to start pointing
+    // somewhere else. `wx+` on the create branch is itself atomic
+    // create-if-absent (and still readable, unlike plain `wx`), closing
+    // the same race on the exists check too.
+    let fd;
+    try {
+      fd = fs.openSync(rc, 'r+');
+    } catch (e) {
+      if (e.code !== 'ENOENT') throw e;
+      fd = fs.openSync(rc, 'wx+');
+    }
+    try {
+      const existing = fs.readFileSync(fd, 'utf8');
+      if (existing.includes(MARKER)) continue;
+      fs.writeSync(fd, block); // position advanced to EOF by the read above
+      added = true;
+    } finally {
+      fs.closeSync(fd);
+    }
   }
   return added;
 }

package/npm/scripts/shortcut.js

@@ -44,8 +44,15 @@ function createWindows() {
   // Run from a temp .ps1 FILE, not an inline -Command: passing a long quoted
   // command through Node→Windows arg-escaping mangles the quotes and produces
   // an empty shortcut. A -File avoids all of that.
-  const ps1 = path.join(os.tmpdir(), `att-shortcut-${process.pid}.ps1`);
-  fs.writeFileSync(ps1, lines.join('\r\n') + '\r\n', 'utf8');
+  //
+  // mkdtempSync (not a PID-based name in os.tmpdir() directly) gives a
+  // freshly-created, uniquely-named, current-user-owned directory — a
+  // predictable path there is guessable/plantable by another local account
+  // ahead of time (symlink pre-plant), which a plain writeFileSync would
+  // silently follow and overwrite.
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'att-shortcut-'));
+  const ps1 = path.join(tmpDir, 'shortcut.ps1');
+  fs.writeFileSync(ps1, lines.join('\r\n') + '\r\n', { encoding: 'utf8', flag: 'wx' });
   try {
     const r = spawnSync(
       'powershell',
@@ -55,7 +62,7 @@ function createWindows() {
     return r.status === 0 && fs.existsSync(lnk) ? lnk : null;
   } finally {
     try {
-      fs.unlinkSync(ps1);
+      fs.rmSync(tmpDir, { recursive: true, force: true });
     } catch (_e) {
       /* ignore */
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-takkub",
-  "version": "1.0.63",
+  "version": "1.0.67",
   "description": "Desktop cockpit for orchestrating a team of Claude Code agents (Windows + macOS). Install globally: npm i -g agent-takkub",
   "keywords": [
     "claude",