codex-copilot-dx 0.6.15 → 0.6.19

package/README.md

@@ -143,7 +143,8 @@ integrity, isolated Claude profile, and live relay routing without changing file
 ccdx pms status
 ```
 
-`ccdx pm-studio status` and `ccdx pm-studio setup` are equivalent long-form aliases.
+`ccdx pm-studio status`, `ccdx pm-studio setup`, and `ccdx pm-studio restore`
+are equivalent long-form aliases.
 
 `ccdx pms setup` performs local preflight, structural verification, backup,
 staging, integrity, signing, and replacement work. It does not access a PM
@@ -183,37 +184,47 @@ require reinstalling PM Studio. Setup prints the verified backup and
 manifest paths plus the version-matched restore procedure. Never restore a
 backup over a different PM Studio version or build.
 
-To restore, first quit PM Studio and its updater. Use the exact verified backup
-path printed by setup as `BACKUP_APP`, then confirm that both the installed App
-and backup still report the same version/build printed by setup:
+To restore the original local bundle, first quit PM Studio and its updater,
+then run:
 
 ```bash
-BACKUP_APP="<verified-backup-path-from-ccdx-pms-setup>"
-/usr/bin/plutil -extract CFBundleShortVersionString raw -o - "/Applications/PM Studio.app/Contents/Info.plist"
-/usr/bin/plutil -extract CFBundleVersion raw -o - "/Applications/PM Studio.app/Contents/Info.plist"
-/usr/bin/plutil -extract CFBundleShortVersionString raw -o - "$BACKUP_APP/Contents/Info.plist"
-/usr/bin/plutil -extract CFBundleVersion raw -o - "$BACKUP_APP/Contents/Info.plist"
+ccdx pms restore
 ```
 
-Only when all four values match each other and the version/build recorded in the
-source-bound manifest, move the patched App aside, restore the complete local
-bundle, and verify it before launch:
+The explicit command authorizes the local App replacement and does not show an
+additional confirmation prompt. Restore neither needs the Claude profile nor
+starts the adapter, Device Flow, Codex, or PM Studio. It selects the unique
+source-bound backup itself, verifies the installed patch record and the exact
+clean backup, stages and verifies the complete bundle, confirms that the
+installed App did not change during staging, and then performs an atomic
+replacement. It never restores a missing, ambiguous, drifted, or
+version/build-mismatched record. The original local signature is inspected and
+reported, but is not an admission gate: the exact source-bound content recorded
+when setup created the backup is authoritative. The verified backup and manifest
+remain available after a successful restore. Repeating restore on the same
+recorded clean App is safe and does not replace it again.
+
+If automatic restore reports that the replacement state cannot be verified, do
+not launch PM Studio. Keep the recovery path printed by the command and reinstall
+PM Studio. The following manual procedure is only an exceptional recovery path;
+use the exact backup and manifest paths printed by setup or restore, and first
+confirm that the installed App and backup still match the manifest version/build:
 
 ```bash
+BACKUP_APP="<exact-verified-backup-path>"
 RECOVERY_DIR="$(/usr/bin/mktemp -d '/Applications/CCDX-PM-Studio-recovery.XXXXXX')"
 PATCHED_APP="$RECOVERY_DIR/PM Studio.app"
 mv "/Applications/PM Studio.app" "$PATCHED_APP"
 /usr/bin/ditto --rsrc --extattr --acl "$BACKUP_APP" "/Applications/PM Studio.app"
-/usr/bin/codesign --verify --deep --strict --verbose=2 "/Applications/PM Studio.app"
 ccdx pms status
 ```
 
 The App-patch row from `ccdx pms status` must classify the restored bundle as
 the recorded clean local content rather than integrity drift. If the version
-check, copy, or either verification path fails,
+check, copy, or content verification fails,
 do not launch the restored App. Keep the moved patched bundle at `$PATCHED_APP`
 and reinstall PM Studio instead of applying a version-mismatched
-backup. CCDX never runs these restore commands or `sudo` automatically.
+backup. CCDX never uses `sudo` automatically.
 
 To change the model used by Codex Auto-review, run:
 
@@ -367,6 +378,8 @@ Environment variables:
 | `CCDX_MAX_BODY_BYTES` | `67108864` | Maximum compressed/raw request body size |
 | `CCDX_MAX_DECODED_BODY_BYTES` | `134217728` | Maximum decoded request body size after decompression |
 | `CCDX_MAX_INFLIGHT_BODY_BYTES` | `33554432` | Per-pool byte budget for raw bodies, decoded bodies, and materialized response history; a larger item runs exclusively in its pool |
+| `CCDX_MAX_UPSTREAM_CHAT_RESPONSE_BYTES` | `67108864` | Maximum buffered successful Chat Completions response used by Responses, Anthropic, and PM Studio conversion paths |
+| `CCDX_MAX_UPSTREAM_RESPONSES_RESPONSE_BYTES` | `268435456` | Maximum buffered successful native Responses or compact response; streaming Responses are forwarded with bounded backpressure instead |
 | `CCDX_MAX_QUEUED_REQUESTS` | `16` | Maximum body requests waiting for the shared byte budget |
 | `CCDX_REQUEST_QUEUE_TIMEOUT_MS` | `120000` | Maximum wait for request-body admission before returning `503` |
 | `CCDX_REQUEST_BODY_TIMEOUT_MS` | `120000` | Maximum time to receive and decode one request body before returning `408` |

package/bin/cli.mjs

@@ -17,6 +17,7 @@ import { assertSafeAdapterHost, isLoopbackHost } from "../src/security.mjs";
 import { runInBackground } from "../src/startup.mjs";
 import { cliCommandName, cliHelp, parseAdapterProbeOptions, parseCliArgs, parseRuntimeOptions } from "../src/cli-options.mjs";
 import { formatAdapterStatus, readAdapterStatus } from "../src/cli-status.mjs";
+import { formatCliError } from "../src/cli-error.mjs";
 import { closeHttpServer } from "../src/shutdown.mjs";
 import { runAutoReviewModelCommand } from "../src/auto-review-model.mjs";
 import { autoReviewModelPreference } from "../src/user-settings.mjs";
@@ -143,11 +144,16 @@ if (CLI.command === "pms") {
       });
       process.exit(result.ok ? 0 : 1);
     }
+    if (CLI.action === "restore") {
+      const { runPmStudioRestore } = await import("../src/pm-studio-setup.mjs");
+      await runPmStudioRestore({ commandName: CLI_NAME });
+      process.exit(0);
+    }
     const { runPmStudioSetup } = await import("../src/pm-studio-setup.mjs");
     await runPmStudioSetup({ commandName: CLI_NAME });
     process.exit(0);
   } catch (e) {
-    console.error(status("err", e.message));
+    console.error(formatCliError(e));
     process.exit(1);
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-copilot-dx",
-  "version": "0.6.15",
+  "version": "0.6.19",
   "description": "Use Codex Desktop, Claude Code, and Claude App with GitHub Copilot",
   "author": "Dale Xiao",
   "type": "module",

package/src/adapter.mjs

@@ -15,6 +15,7 @@ import { createPmStudioRelayHandler, PM_STUDIO_RELAY_PREFIX } from "./pm-studio-
 import { createStreamPerformanceMetrics } from "./stream-performance.mjs";
 import { status } from "./status.mjs";
 import { createTerminalActivityIndicator } from "./terminal-activity.mjs";
+import { createTokenCounterService } from "./token-counter-service.mjs";
 import { ADAPTER_HEALTH_PATH, adapterHealthPayload } from "./running-adapter.mjs";
 import { createResponsesCompactHandler, createResponsesHandler } from "./responses-handler.mjs";
 import { createResponsesImagePressureController } from "./responses-image-pressure.mjs";
@@ -145,6 +146,11 @@ export function createAdapterHandler(options = {}) {
   const requestMetrics = options.requestMetrics || createRequestMetrics();
   const streamPerformanceMetrics = options.streamPerformanceMetrics || createStreamPerformanceMetrics();
   const imagePressure = options.imagePressure || createResponsesImagePressureController();
+  const ownsTokenCounterService = !options.tokenCounterService;
+  const tokenCounterService = options.tokenCounterService || createTokenCounterService({
+    timeoutMs: options.countTokensTimeoutMs,
+    maxQueued: options.countTokensMaxQueued,
+  });
   const claudeDesktopModelOptions = () => {
     const modelDefs = claudeModelRegistry?.modelDefs || options.claudeDesktopModelDefs;
     return Array.isArray(modelDefs) ? { modelDefs } : {};
@@ -155,6 +161,7 @@ export function createAdapterHandler(options = {}) {
     chatCompletionsFn: codexChatCompletionsFn,
     getCachedModelEndpointsFn,
     imagePressure,
+    modelRegistry: codexModelRegistry,
     now: options.now,
     openAIModelEnv,
     responsesPayloadOptions: options.responsesPayloadOptions,
@@ -168,6 +175,7 @@ export function createAdapterHandler(options = {}) {
     acquireRequest,
     autoReviewModelResolver: options.autoReviewModelResolver,
     imagePressure,
+    modelRegistry: codexModelRegistry,
     now: options.now,
     openAIModelEnv,
     requestBodyTimeoutMs,
@@ -176,7 +184,11 @@ export function createAdapterHandler(options = {}) {
     streamIdleTimeoutMs,
     upstreamTimeoutMs,
   });
-  const anthropicCountTokensHandler = createAnthropicCountTokensHandler({ acquireRequest, requestBodyTimeoutMs });
+  const anthropicCountTokensHandler = createAnthropicCountTokensHandler({
+    acquireRequest,
+    requestBodyTimeoutMs,
+    countTokensFn: (body, countOptions) => tokenCounterService.count(body, countOptions),
+  });
   const anthropicMessagesHandler = createAnthropicMessagesHandler({
     acquireRequest,
     chatCompletionsFn: claudeChatCompletionsFn,
@@ -294,8 +306,11 @@ export function createAdapterHandler(options = {}) {
     res.writeHead(404, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ error: "Not found" }));
   };
+  const dispatchRequest = typeof options.dispatchRequestForTests === "function"
+    ? options.dispatchRequestForTests
+    : dispatch;
 
-  return (req, res) => {
+  const handler = (req, res) => {
     const requestId = createRequestId();
     if (typeof res.setHeader === "function") {
       res.setHeader("X-Request-Id", requestId);
@@ -326,10 +341,28 @@ export function createAdapterHandler(options = {}) {
     const finishRequest = ({ statusCode = 0, aborted = false } = {}) => {
       if (requestFinished) return;
       requestFinished = true;
-      complete({ statusCode, aborted });
-      streamPerformance?.finish({ failed: aborted || statusCode >= 400 });
+      try { complete({ statusCode, aborted }); } catch {}
+      try { streamPerformance?.finish({ failed: aborted || statusCode >= 400 }); } catch {}
       try { finishTerminalActivity(); } catch {}
     };
+    const containUnexpectedError = (error) => {
+      try { finishRequest({ statusCode: res.statusCode >= 400 ? res.statusCode : 500 }); } catch {}
+      const safeCause = error instanceof Error ? error : new Error("Unexpected adapter failure");
+      try { logRequestFailure("Adapter", safeCause); } catch {}
+      try {
+        const safeError = httpError("Internal adapter error", 500);
+        safeError.jsonBody = {
+          error: {
+            message: safeError.message,
+            type: "server_error",
+            code: "ccdx_internal_error",
+          },
+        };
+        sendJsonError(res, safeError, 500);
+      } catch {
+        try { res.destroy?.(); } catch {}
+      }
+    };
     if (trackRequest && typeof res.once === "function") {
       res.once("finish", () => finishRequest({ statusCode: res.statusCode }));
       res.once("close", () => finishRequest({
@@ -344,19 +377,21 @@ export function createAdapterHandler(options = {}) {
         pathname,
         showRequestId: options.showRequestId === true,
         streamPerformance,
-      }, () => dispatch(req, res, pathname));
+      }, () => dispatchRequest(req, res, pathname));
       if (result && typeof result.then === "function") {
         return result.catch((error) => {
-          finishRequest({ statusCode: res.statusCode >= 400 ? res.statusCode : 500 });
-          throw error;
+          containUnexpectedError(error);
         });
       }
       return result;
     } catch (error) {
-      finishRequest({ statusCode: res.statusCode >= 400 ? res.statusCode : 500 });
-      throw error;
+      containUnexpectedError(error);
     }
   };
+  handler.cleanup = () => {
+    if (ownsTokenCounterService) tokenCounterService.close();
+  };
+  return handler;
 }
 
 // Public server entry point.
@@ -364,9 +399,11 @@ export function createAdapterHandler(options = {}) {
 export function startAdapter(port = 2026, host = "127.0.0.1", options = {}) {
   const ownsTerminalActivity = !Object.hasOwn(options, "terminalActivity");
   const terminalActivity = ownsTerminalActivity ? createTerminalActivityIndicator() : options.terminalActivity;
-  const server = http.createServer(createAdapterHandler({ ...options, terminalActivity }));
+  const handler = createAdapterHandler({ ...options, terminalActivity });
+  const server = http.createServer(handler);
   const cleanupTerminalActivity = () => {
     if (ownsTerminalActivity) terminalActivity?.cleanup?.();
+    handler.cleanup?.();
   };
   server.once("close", cleanupTerminalActivity);
 

package/src/anthropic-handler.mjs

@@ -7,7 +7,10 @@ import {
 import {
   createRequestAbort,
   logRequestFailure,
+  MAX_UPSTREAM_CHAT_SUCCESS_BODY_BYTES,
+  MAX_UPSTREAM_ERROR_BODY_BYTES,
   readJsonBody,
+  readBoundedResponseText,
   sendJsonError,
   sendUpstreamError,
   writeOrDrain,
@@ -21,6 +24,7 @@ import { safeUpstreamResponseHeaders } from "./upstream-headers.mjs";
 import { recordAnthropicUsage } from "./usage.mjs";
 
 const PROMPT_TOO_LONG_MESSAGE = "prompt is too long: your prompt is too long. Please reduce the number of messages or use a model with a larger context window.";
+const DOWNSTREAM_CLOSED = Symbol("downstream-closed");
 
 function contextWindowErrorBody(text) {
   let error;
@@ -57,7 +61,7 @@ function sendAnthropicUpstreamError(res, response, text) {
 }
 
 export function createAnthropicCountTokensHandler(options) {
-  const { acquireRequest, requestBodyTimeoutMs } = options;
+  const { acquireRequest, requestBodyTimeoutMs, countTokensFn = countTokens } = options;
 
   return async function handleAnthropicCountTokens(req, res) {
     const abort = createRequestAbort(req, res);
@@ -67,12 +71,12 @@ export function createAnthropicCountTokensHandler(options) {
       abort.setTimeout(requestBodyTimeoutMs, "request_body_timeout");
       const parsed = await readJsonBody(req, { admission: releaseRequest, signal: abort.signal });
       abort.clearTimeout();
-      const result = await countTokens(parsed);
+      const result = await countTokensFn(parsed, { signal: abort.signal });
       releaseRequest();
       res.writeHead(200, { "Content-Type": "application/json" });
       res.end(JSON.stringify(result));
     } catch (error) {
-      sendJsonError(res, error, abort.reason === "request_body_timeout" ? 408 : 400);
+      sendJsonError(res, error, abort.reason === "request_body_timeout" ? 408 : 500);
     } finally {
       releaseRequest();
       abort.cleanup();
@@ -112,7 +116,10 @@ export function createAnthropicMessagesHandler(options) {
         const upstream = await chatCompletionsFn(withChatStreamUsage(chatReq), { signal: abort.signal });
         releaseRequest();
         if (!upstream.ok) {
-          sendAnthropicUpstreamError(res, upstream, await upstream.text());
+          sendAnthropicUpstreamError(res, upstream, await readBoundedResponseText(upstream, {
+            maxBytes: MAX_UPSTREAM_ERROR_BODY_BYTES,
+            label: "Copilot Chat error body",
+          }));
           return;
         }
         await requireUpstreamEventStream(upstream);
@@ -132,12 +139,15 @@ export function createAnthropicMessagesHandler(options) {
             async (event, data) => {
               if (event === "message_start") messageId = data.message?.id;
               if (event === "message_delta") usage = data.usage;
-              await writeOrDrain(res, `event: ${event}\ndata: ${JSON.stringify(data)}\n\n`);
+              if (!await writeOrDrain(res, `event: ${event}\ndata: ${JSON.stringify(data)}\n\n`)) {
+                throw DOWNSTREAM_CLOSED;
+              }
             },
             requestedModel,
             { forceModel: forceRequestedModel },
           );
         } catch (error) {
+          if (error === DOWNSTREAM_CLOSED) return;
           logRequestFailure("Messages", error, abort);
           await endStreamWithError(res, "anthropic", error, abort);
           return;
@@ -147,7 +157,16 @@ export function createAnthropicMessagesHandler(options) {
       } else {
         const upstream = await chatCompletionsFn({ ...chatReq, stream: false }, { signal: abort.signal });
         releaseRequest();
-        const data = await upstream.text();
+        const data = upstream.ok
+          ? await readBoundedResponseText(upstream, {
+            maxBytes: MAX_UPSTREAM_CHAT_SUCCESS_BODY_BYTES,
+            label: "Copilot Chat success body",
+            signal: abort.signal,
+          })
+          : await readBoundedResponseText(upstream, {
+            maxBytes: MAX_UPSTREAM_ERROR_BODY_BYTES,
+            label: "Copilot Chat error body",
+          });
         if (!upstream.ok) {
           sendAnthropicUpstreamError(res, upstream, data);
           return;

package/src/anthropic.mjs

@@ -163,6 +163,10 @@ export function anthropicToChat(body, options = {}) {
 
 function uid() { return randomUUID().replace(/-/g, ""); }
 
+function nonNegativeTokenCount(value) {
+  return Number.isFinite(value) ? Math.max(0, value) : 0;
+}
+
 function invalidToolArguments(toolName) {
   const name = String(toolName || "unknown").slice(0, 100);
   return invalidUpstreamStream(
@@ -198,10 +202,11 @@ export function chatToAnthropic(openaiResp, model, options = {}) {
   }
 
   const u = openaiResp.usage || {};
-  const cached = u.prompt_tokens_details?.cached_tokens ?? 0;
+  const prompt = nonNegativeTokenCount(u.prompt_tokens);
+  const cached = Math.min(prompt, nonNegativeTokenCount(u.prompt_tokens_details?.cached_tokens));
   const usage = {
-    input_tokens: (u.prompt_tokens ?? 0) - cached,
-    output_tokens: u.completion_tokens ?? 0,
+    input_tokens: prompt - cached,
+    output_tokens: nonNegativeTokenCount(u.completion_tokens),
   };
   if (cached > 0) usage.cache_read_input_tokens = cached;
 
@@ -281,7 +286,7 @@ export async function streamAnthropicFromLines(lineIterator, emit, model, option
     if (upstreamError) throw upstreamError;
     if (!options.forceModel && parsed.model) actualModel = parsed.model;
     if (parsed.usage?.completion_tokens != null) {
-      outputTokens = parsed.usage.completion_tokens;
+      outputTokens = nonNegativeTokenCount(parsed.usage.completion_tokens);
       markOutputTokens(outputTokens);
     }
     const choice = parsed.choices?.[0];
@@ -345,8 +350,7 @@ export async function streamAnthropicFromLines(lineIterator, emit, model, option
   await emit("message_stop", { type: "message_stop" });
 }
 
-// Copilot has no count_tokens endpoint; estimate locally with gpt-tokenizer.
-export async function countTokens(body) {
+export function anthropicTokenText(body) {
   const parts = [];
   const sys = systemToText(body.system);
   if (sys) parts.push(sys);
@@ -369,7 +373,15 @@ export async function countTokens(body) {
     }
   }
 
-  const text = parts.join("\n");
+  return parts.join("\n");
+}
+
+export async function countTokenText(text) {
   const count = await tokenCounter();
   return { input_tokens: count(text) };
 }
+
+// Copilot has no count_tokens endpoint; estimate locally with gpt-tokenizer.
+export async function countTokens(body) {
+  return countTokenText(anthropicTokenText(body));
+}

package/src/atomic-file.mjs

@@ -24,9 +24,12 @@ function syncDirectory(directory) {
   }
 }
 
-export function atomicWriteFileSync(filePath, data, { mode = 0o600 } = {}) {
+export function atomicWriteFileSync(filePath, data, {
+  mode = 0o600,
+  preserveMode = true,
+} = {}) {
   const directory = path.dirname(filePath);
-  const finalMode = existingMode(filePath, mode);
+  const finalMode = preserveMode ? existingMode(filePath, mode) : mode;
   const tempPath = path.join(directory, `.${path.basename(filePath)}.${process.pid}.${randomUUID()}.tmp`);
   fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
 
@@ -50,6 +53,77 @@ export function atomicWriteFileSync(filePath, data, { mode = 0o600 } = {}) {
   }
 }
 
+function fileSnapshot(filePath) {
+  try {
+    return {
+      exists: true,
+      data: fs.readFileSync(filePath),
+      mode: fs.statSync(filePath).mode & 0o777,
+    };
+  } catch (error) {
+    if (error?.code === "ENOENT") return { exists: false, data: null, mode: 0o600 };
+    throw error;
+  }
+}
+
+function removeFile(filePath, unlinkFile) {
+  try {
+    unlinkFile(filePath);
+  } catch (error) {
+    if (error?.code !== "ENOENT") throw error;
+  }
+}
+
+function writeExactMode(filePath, data, mode, writeFile) {
+  writeFile(filePath, data, { mode, preserveMode: false });
+  fs.chmodSync(filePath, mode);
+}
+
+function restoreFile(filePath, snapshot, { writeFile, unlinkFile }) {
+  if (snapshot.exists) {
+    writeExactMode(filePath, snapshot.data, snapshot.mode, writeFile);
+    return;
+  }
+  removeFile(filePath, unlinkFile);
+}
+
+// Commit a primary file first and its metadata/activation marker last. A null
+// secondary value removes stale metadata as the final transaction step.
+export function atomicWriteFilePairSync(
+  primaryPath,
+  primaryData,
+  secondaryPath,
+  secondaryData,
+  {
+    mode = 0o600,
+    writeFile = atomicWriteFileSync,
+    unlinkFile = fs.unlinkSync,
+  } = {},
+) {
+  const primarySnapshot = fileSnapshot(primaryPath);
+  const secondarySnapshot = fileSnapshot(secondaryPath);
+
+  try {
+    writeExactMode(primaryPath, primaryData, mode, writeFile);
+    if (secondaryData === null) removeFile(secondaryPath, unlinkFile);
+    else writeExactMode(secondaryPath, secondaryData, mode, writeFile);
+  } catch (error) {
+    let rollbackError;
+    try {
+      restoreFile(primaryPath, primarySnapshot, { writeFile, unlinkFile });
+    } catch (cause) {
+      rollbackError = cause;
+    }
+    try {
+      restoreFile(secondaryPath, secondarySnapshot, { writeFile, unlinkFile });
+    } catch (cause) {
+      rollbackError ||= cause;
+    }
+    if (rollbackError) error.rollbackError = rollbackError;
+    throw error;
+  }
+}
+
 export function atomicWriteFileIfChangedSync(filePath, data, options = {}) {
   try {
     const current = fs.readFileSync(filePath);

package/src/auth-profile.mjs

@@ -1,7 +1,7 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { atomicWriteFileSync } from "./atomic-file.mjs";
+import { atomicWriteFilePairSync, atomicWriteFileSync } from "./atomic-file.mjs";
 import {
   githubTokenLockPath,
   githubTokenMetadataPath,
@@ -131,27 +131,11 @@ export function withAuthProfileLock(profile, fn, {
   return withFileLock(lockPath, fn, { ...lockOptions(env), ...options });
 }
 
-function writeSecret(filePath, data, writeFile) {
-  writeFile(filePath, data, { mode: 0o600 });
-  fs.chmodSync(filePath, 0o600);
-}
-
-function restoreSnapshot(filePath, snapshot, writeFile) {
-  if (snapshot.exists) {
-    writeSecret(filePath, snapshot.data, writeFile);
-    return;
-  }
-  try {
-    fs.unlinkSync(filePath);
-  } catch (error) {
-    if (error?.code !== "ENOENT") throw error;
-  }
-}
-
 export function writeClaudeAuthProfile(token, identity, {
   home = os.homedir(),
   now = () => new Date(),
   writeFile = atomicWriteFileSync,
+  unlinkFile = fs.unlinkSync,
 } = {}) {
   const cleanToken = String(token || "").trim();
   const normalizedIdentity = normalizeGithubIdentity(identity);
@@ -163,8 +147,6 @@ export function writeClaudeAuthProfile(token, identity, {
   fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
   fs.chmodSync(directory, 0o700);
 
-  const previousToken = readOptionalFile(paths.tokenPath);
-  const previousMetadata = readOptionalFile(paths.metadataPath);
   const timestamp = now();
   const updatedAt = timestamp instanceof Date ? timestamp.toISOString() : new Date(timestamp).toISOString();
   const metadata = `${JSON.stringify({
@@ -174,20 +156,15 @@ export function writeClaudeAuthProfile(token, identity, {
     updated_at: updatedAt,
   }, null, 2)}\n`;
 
-  try {
-    writeSecret(paths.tokenPath, cleanToken, writeFile);
-    // Commit the activation marker last. Readers never observe a configured
-    // Claude profile unless the token and its fingerprint agree.
-    writeSecret(paths.metadataPath, metadata, writeFile);
-  } catch (error) {
-    try {
-      restoreSnapshot(paths.tokenPath, previousToken, writeFile);
-      restoreSnapshot(paths.metadataPath, previousMetadata, writeFile);
-    } catch (rollbackError) {
-      error.rollbackError = rollbackError;
-    }
-    throw error;
-  }
+  // Commit the activation marker last. Readers never observe a configured
+  // Claude profile unless the token and its fingerprint agree.
+  atomicWriteFilePairSync(
+    paths.tokenPath,
+    cleanToken,
+    paths.metadataPath,
+    metadata,
+    { mode: 0o600, writeFile, unlinkFile },
+  );
 
   return {
     profile: AUTH_PROFILE_CLAUDE,