dsh-global-todo 0.12.5 → 0.12.6

package/CHANGELOG.md

@@ -1,3 +1,19 @@
+## [0.12.6] — 2026-10-21
+
+Saving on Windows never worked. Fixed, with the root cause written down (#2).
+
+- **`open(temp, 'r')` → opened for writing.** The atomic write reopened its temp file read-only
+  and called `handle.sync()`. On Windows that is `FlushFileBuffers`, which requires a writable
+  handle, so **every** save threw `EPERM` — and because the sync sat before `rename()`, the
+  target file was never replaced: the list looked empty while `*.tmp` debris accumulated. POSIX
+  allows `fsync` on a read-only descriptor, which is why Linux and macOS never showed it.
+- **The sync is best effort now.** A platform that refuses to flush the temp file gets a warning,
+  and the rename still happens: losing a save is worse than a save that only reached the page
+  cache. The temp file is unlinked when a write fails, so a failure leaves no debris.
+- **The write path is a function with tests.** `atomicWrite()` takes an injectable fs surface; four
+  tests pin the invariant that failed: the handle must be opened for writing, a refused sync must
+  not lose the save, a failed write must clean up, and the payload must reach the file first.
+
 ## [0.12.5] — 2026-10-21
 
 A check for the one install mistake that is invisible until the desktop complains.

package/lib/index.js

@@ -36,7 +36,7 @@ import { createStore, resolveStorePath } from './store.js'
 import { createTools } from './tools.js'
 
 /** Must equal `package.json`'s version; `npm run check` enforces that. */
-export const VERSION = '0.12.5'
+export const VERSION = '0.12.6'
 
 /** Plugin id. Also the Loader row id in `cordis.patch.yml`. */
 export const name = 'dsh-global-todo'

package/lib/store.js

@@ -19,7 +19,48 @@
  * @module dsh-global-todo/store
  */
 
-import { open, mkdir, readFile, rename, stat, writeFile } from 'node:fs/promises'
+import { open, mkdir, readFile, rename, stat, unlink } from 'node:fs/promises'
+
+/**
+ * Replace a file atomically, and survive a platform that refuses `fsync`.
+ *
+ * Opened for **writing** on purpose: on Windows `handle.sync()` is `FlushFileBuffers`,
+ * which needs a writable handle. Opening the temp file read-only and syncing it threw
+ * `EPERM` on every write, and because that sync sat before `rename()`, the target file
+ * was never replaced — the list looked empty while the data piled up as `*.tmp` debris.
+ * That was issue #2.
+ *
+ * The sync itself is best effort: durability matters, but losing a save because a
+ * platform will not flush a handle is strictly worse than a save that reaches the page
+ * cache. A failing sync is reported and the rename still happens.
+ *
+ * @param {string} file absolute path of the target
+ * @param {string} payload bytes to write
+ * @param {{ fs?: object, onSyncError?: (error: unknown) => void }} [options] injected for tests
+ */
+export async function atomicWrite(file, payload, options = {}) {
+  const io = options.fs ?? { open, rename, unlink }
+  const temp = `${file}.${process.pid}.${Date.now()}.tmp`
+  let handle = null
+  let renamed = false
+  try {
+    handle = await io.open(temp, 'w', 0o600)
+    await handle.writeFile(payload, 'utf8')
+    try {
+      await handle.sync()
+    } catch (error) {
+      options.onSyncError?.(error)
+    }
+    await handle.close()
+    handle = null
+    await io.rename(temp, file)
+    renamed = true
+  } finally {
+    if (handle !== null) await handle.close().catch(() => {})
+    // Only debris is cleaned up: after a successful rename the temp file is gone.
+    if (!renamed) await io.unlink(temp).catch(() => {})
+  }
+}
 import { homedir } from 'node:os'
 import path from 'node:path'
 
@@ -187,16 +228,12 @@ export function createStore(options) {
     const directory = path.dirname(file)
     await mkdir(directory, { recursive: true })
     const payload = `${JSON.stringify({ version: SCHEMA_VERSION, todos: doc.todos }, null, 2)}\n`
-    const temp = `${file}.${process.pid}.${now()}.tmp`
     try {
-      await writeFile(temp, payload, { mode: 0o600 })
-      const handle = await open(temp, 'r')
-      try {
-        await handle.sync()
-      } finally {
-        await handle.close()
-      }
-      await rename(temp, file)
+      await atomicWrite(file, payload, {
+        // A platform that will not flush the temp file is a warning, not a lost save.
+        onSyncError: (error) =>
+          logger?.warn?.(`dsh-global-todo: 落盘后 fsync 失败（已继续）${file}：${error?.message ?? error}`),
+      })
     } catch (error) {
       throw new TodoError('store-unwritable', `写入待办文件失败 ${file}：${error?.message ?? error}`, { file })
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-global-todo",
-  "version": "0.12.5",
+  "version": "0.12.6",
   "icon": "./docs/icon.svg",
   "description": "Cross-session todo list for DeepSeek Harness: one JSON file a person and an agent both write to, with step plans that ship as a numbered hand-off, session read-back, and a human confirmation before an agent's \"done\" counts.",
   "type": "module",