peaks-cli 1.0.7 → 1.0.9

package/dist/src/cli/commands/workflow-commands.js

@@ -4,18 +4,29 @@ import { createWorkflowRouterPlan, isSoloMode, isWorkflowMode } from '../../serv
 import { createAutonomousWorkflowPlan } from '../../services/workflow/workflow-autonomous-service.js';
 import { createRecommendationPlan } from '../../services/recommendations/recommendation-service.js';
 import { createRefactorDryRun } from '../../services/refactor/refactor-service.js';
-import { getCurrentWorkspaceConfig, readConfig } from '../../services/config/config-service.js';
+import { ensureWorkspaceConfigForCurrentPath, getCurrentWorkspaceConfig, readConfig } from '../../services/config/config-service.js';
 import { validateChangeIdOrThrow } from '../../shared/change-id.js';
 import { getEconomyAwareExecutionModelId } from '../../services/config/model-routing.js';
 import { getLocalArtifactPath } from '../../services/artifacts/workspace-service.js';
 import { fail, ok } from '../../shared/result.js';
 import { addJsonOption, failUnsupportedNonDryRun, getErrorMessage, isRecommendationWorkflow, printResult } from '../cli-helpers.js';
-function getWorkspaceContext() {
+function getCurrentWorkspaceContext() {
     const workspace = getCurrentWorkspaceConfig();
     if (!workspace)
         return {};
     return { workspace, artifactWorkspacePath: getLocalArtifactPath(workspace) };
 }
+function getWorkflowWorkspaceContext() {
+    try {
+        const workspace = ensureWorkspaceConfigForCurrentPath() ?? getCurrentWorkspaceConfig();
+        if (!workspace)
+            return {};
+        return { workspace, artifactWorkspacePath: getLocalArtifactPath(workspace) };
+    }
+    catch {
+        return {};
+    }
+}
 function parseMaxWorkers(io, command, value, asJson) {
     const maxWorkers = Number(value);
     if (!Number.isInteger(maxWorkers) || maxWorkers < 1) {
@@ -54,7 +65,7 @@ function runTechPlan(io, options) {
     }
     try {
         validatePlanningInput(options.changeId, options.goal);
-        const workspaceContext = getWorkspaceContext();
+        const workspaceContext = getCurrentWorkspaceContext();
         const plan = createTechPlan({
             changeId: options.changeId,
             goal: options.goal,
@@ -71,7 +82,7 @@ function runTechPlan(io, options) {
 }
 function runTechStatus(io, options) {
     try {
-        const workspaceContext = getWorkspaceContext();
+        const workspaceContext = getCurrentWorkspaceContext();
         printResult(io, ok('tech.status', getTechStatus({ changeId: options.changeId, ...workspaceContext })), options.json);
     }
     catch (error) {
@@ -97,7 +108,7 @@ function runWorkflowRoute(io, options) {
         return;
     try {
         validatePlanningInput(options.changeId, options.goal);
-        const workspaceContext = getWorkspaceContext();
+        const workspaceContext = getWorkflowWorkspaceContext();
         const plan = createWorkflowRouterPlan({
             changeId: options.changeId,
             goal: options.goal,
@@ -133,7 +144,7 @@ function runAutonomousWorkflow(io, options) {
         return;
     try {
         validatePlanningInput(options.changeId, options.goal);
-        const workspaceContext = getWorkspaceContext();
+        const workspaceContext = getWorkflowWorkspaceContext();
         const plan = createAutonomousWorkflowPlan({
             changeId: options.changeId,
             goal: options.goal,
@@ -166,7 +177,7 @@ function runSwarmPlan(io, options) {
         return;
     try {
         validatePlanningInput(options.changeId, options.goal);
-        const workspaceContext = getWorkspaceContext();
+        const workspaceContext = getWorkflowWorkspaceContext();
         const config = readConfig();
         const plan = createRdSwarmPlan({
             skill: 'rd',

package/dist/src/services/config/config-service.d.ts

@@ -28,4 +28,8 @@ export declare function addWorkspace(workspace: WorkspaceConfig, layer?: ConfigL
 export declare function removeWorkspace(workspaceId: string, layer?: ConfigLayer): boolean;
 export declare function setCurrentWorkspace(workspaceId: string, layer?: ConfigLayer): boolean;
 export declare function getCurrentWorkspaceConfig(): WorkspaceConfig | null;
+export declare function getWorkspaceConfigForPath(path?: string): WorkspaceConfig | null;
+export declare function ensureWorkspaceConfigForPath(path?: string): WorkspaceConfig | null;
+export declare function getWorkspaceConfigForCurrentPath(): WorkspaceConfig | null;
+export declare function ensureWorkspaceConfigForCurrentPath(): WorkspaceConfig | null;
 export type { TokenRef, WorkspaceConfig, PeaksConfig, ConfigLayer };

package/dist/src/services/config/config-service.js

@@ -1,7 +1,9 @@
-import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
-import { dirname, isAbsolute, relative, resolve } from 'node:path';
+import { closeSync, constants, existsSync, fchmodSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { basename, dirname, isAbsolute, relative, resolve } from 'node:path';
 import { homedir } from 'node:os';
 import { DEFAULT_CONFIG } from './config-types.js';
+import { stablePath } from '../../shared/path-utils.js';
 function getUserConfigPath() {
     return resolve(homedir(), '.peaks', 'config.json');
 }
@@ -14,7 +16,13 @@ function isSafeProjectConfigMarker(projectRoot) {
     const markerPath = resolve(peaksPath, 'config.json');
     try {
         const projectRootReal = realpathSync(projectRoot);
+        const peaksStats = lstatSync(peaksPath);
         const peaksReal = realpathSync(peaksPath);
+        const markerStats = lstatSync(markerPath);
+        if (!peaksStats.isDirectory() || peaksStats.isSymbolicLink())
+            return false;
+        if (!markerStats.isFile() || markerStats.isSymbolicLink() || markerStats.nlink !== 1)
+            return false;
         const markerReal = realpathSync(markerPath);
         if (!isInsidePath(peaksReal, projectRootReal))
             return false;
@@ -26,10 +34,25 @@ function isSafeProjectConfigMarker(projectRoot) {
         return false;
     }
 }
+function normalizeBoundaryPath(path) {
+    const resolved = resolve(path);
+    let realPath = resolved;
+    try {
+        realPath = existsSync(resolved) ? realpathSync.native(resolved) : resolved;
+    }
+    catch {
+        realPath = resolved;
+    }
+    return process.platform === 'win32' || process.platform === 'darwin' ? realPath.toLowerCase() : realPath;
+}
+function getHomeBoundaryPaths() {
+    return new Set([homedir(), process.env.HOME, process.env.USERPROFILE].filter((path) => typeof path === 'string' && path.length > 0).map(normalizeBoundaryPath));
+}
 function findProjectRoot(startPath) {
+    const homeBoundaryPaths = getHomeBoundaryPaths();
     let current = resolve(startPath);
     let parent = dirname(current);
-    while (current !== parent) {
+    while (current !== parent && !homeBoundaryPaths.has(normalizeBoundaryPath(current))) {
         if (existsSync(resolve(current, '.peaks', 'config.json')) && isSafeProjectConfigMarker(current)) {
             return current;
         }
@@ -40,10 +63,10 @@ function findProjectRoot(startPath) {
 }
 export function resolveProjectRootForConfig(startPath) {
     const start = resolve(startPath);
-    const homePath = resolve(homedir());
+    const homeBoundaryPaths = getHomeBoundaryPaths();
     let current = start;
     let parent = dirname(current);
-    while (current !== parent && current !== homePath) {
+    while (current !== parent && !homeBoundaryPaths.has(normalizeBoundaryPath(current))) {
         if (existsSync(resolve(current, '.peaks', 'config.json')) && isSafeProjectConfigMarker(current)) {
             return current;
         }
@@ -87,6 +110,9 @@ function validateProjectBootstrapConfigPath(projectRootPath, peaksPath, configPa
         if (!markerStats.isFile() || markerStats.isSymbolicLink()) {
             throw new Error('Project config path must stay inside the project root');
         }
+        if (markerStats.nlink !== 1) {
+            throw new Error('Config path must not be hardlinked');
+        }
         const markerReal = realpathSync(configPath);
         if (!isInsidePath(markerReal, projectRootReal) || !isInsidePath(markerReal, peaksReal)) {
             throw new Error('Project config path must stay inside the project root');
@@ -102,26 +128,184 @@ function validateProjectBootstrapConfigPathForWrite(projectRoot, configPath) {
     const projectRootPath = resolve(projectRoot);
     validateProjectBootstrapConfigPath(projectRootPath, resolve(projectRootPath, '.peaks'), configPath);
 }
-function readJsonFile(path) {
+function validateUserConfigPathForWrite(configPath) {
+    const userRoot = resolve(homedir());
+    const peaksPath = resolve(userRoot, '.peaks');
+    const userRootReal = realpathSync(userRoot);
+    const peaksStats = lstatSync(peaksPath);
+    const peaksReal = realpathSync(peaksPath);
+    if (!peaksStats.isDirectory() || peaksStats.isSymbolicLink() || peaksReal !== resolve(userRootReal, '.peaks')) {
+        throw new Error('User config path must stay inside the user root');
+    }
+    try {
+        const markerStats = lstatSync(configPath);
+        if (!markerStats.isFile() || markerStats.isSymbolicLink()) {
+            throw new Error('User config path must stay inside the user root');
+        }
+        if (markerStats.nlink !== 1) {
+            throw new Error('Config path must not be hardlinked');
+        }
+        const markerReal = realpathSync(configPath);
+        if (!isInsidePath(markerReal, userRootReal) || !isInsidePath(markerReal, peaksReal)) {
+            throw new Error('User config path must stay inside the user root');
+        }
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT') {
+            throw error;
+        }
+    }
+}
+function validateArtifactWorkspaceRoot(artifactRoot, workspaceRoot) {
+    const artifactStats = lstatSync(artifactRoot);
+    if (!artifactStats.isDirectory() || artifactStats.isSymbolicLink()) {
+        throw new Error('Artifact workspace marker must stay inside the artifact workspace');
+    }
+    const artifactRootReal = realpathSync(artifactRoot);
+    const workspaceRootReal = realpathSync(workspaceRoot);
+    if (isInsidePath(artifactRootReal, workspaceRootReal)) {
+        throw new Error('Artifact workspace must stay outside the project root');
+    }
+}
+function validateArtifactWorkspaceMarkerPath(artifactRoot, peaksPath, markerPath) {
+    const artifactStats = lstatSync(artifactRoot);
+    if (!artifactStats.isDirectory() || artifactStats.isSymbolicLink()) {
+        throw new Error('Artifact workspace marker must stay inside the artifact workspace');
+    }
+    const artifactRootReal = realpathSync(artifactRoot);
+    const peaksStats = lstatSync(peaksPath);
+    const peaksReal = realpathSync(peaksPath);
+    if (!peaksStats.isDirectory() || peaksStats.isSymbolicLink() || peaksReal !== resolve(artifactRootReal, '.peaks')) {
+        throw new Error('Artifact workspace marker must stay inside the artifact workspace');
+    }
+    try {
+        const markerStats = lstatSync(markerPath);
+        if (!markerStats.isFile() || markerStats.isSymbolicLink()) {
+            throw new Error('Artifact workspace marker must stay inside the artifact workspace');
+        }
+        if (markerStats.nlink !== 1) {
+            throw new Error('Config path must not be hardlinked');
+        }
+        const markerReal = realpathSync(markerPath);
+        if (!isInsidePath(markerReal, artifactRootReal) || !isInsidePath(markerReal, peaksReal)) {
+            throw new Error('Artifact workspace marker must stay inside the artifact workspace');
+        }
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT') {
+            throw error;
+        }
+    }
+}
+function validateOpenConfigFile(fd, tempPath, errorMessage) {
+    const fdStats = fstatSync(fd);
+    const pathStats = lstatSync(tempPath);
+    if (!fdStats.isFile() || !pathStats.isFile() || fdStats.dev !== pathStats.dev || fdStats.ino !== pathStats.ino) {
+        throw new Error(errorMessage);
+    }
+    if (fdStats.nlink !== 1 || pathStats.nlink !== 1) {
+        throw new Error('Config path must not be hardlinked');
+    }
+}
+function getSafeTempOpenFlags() {
+    const baseFlags = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL;
+    return typeof constants.O_NOFOLLOW === 'number' ? baseFlags | constants.O_NOFOLLOW : baseFlags;
+}
+function getSafeReadOpenFlags() {
+    return typeof constants.O_NOFOLLOW === 'number' ? constants.O_RDONLY | constants.O_NOFOLLOW : constants.O_RDONLY;
+}
+function readConfigFileSafely(configPath, errorMessage) {
+    const fd = openSync(configPath, getSafeReadOpenFlags());
+    try {
+        validateOpenConfigFile(fd, configPath, errorMessage);
+        return readFileSync(fd, 'utf-8');
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+function writeConfigFileSafely(configPath, content, validateBeforeWrite, errorMessage) {
+    validateBeforeWrite();
+    const tempPath = `${configPath}.${process.pid}.${randomUUID()}.tmp`;
+    let fd = openSync(tempPath, getSafeTempOpenFlags(), 0o600);
+    let renamed = false;
+    let closeError;
+    try {
+        validateOpenConfigFile(fd, tempPath, errorMessage);
+        fchmodSync(fd, 0o600);
+        writeFileSync(fd, content, 'utf-8');
+        const writeFd = fd;
+        fd = null;
+        closeSync(writeFd);
+        validateBeforeWrite();
+        const readFd = openSync(tempPath, getSafeReadOpenFlags());
+        try {
+            validateOpenConfigFile(readFd, tempPath, errorMessage);
+        }
+        finally {
+            closeSync(readFd);
+        }
+        renameSync(tempPath, configPath);
+        renamed = true;
+    }
+    finally {
+        if (fd !== null) {
+            try {
+                closeSync(fd);
+            }
+            catch (error) {
+                closeError = error;
+            }
+        }
+        try {
+            if (!renamed && existsSync(tempPath)) {
+                unlinkSync(tempPath);
+            }
+        }
+        finally {
+            if (closeError) {
+                throw closeError;
+            }
+        }
+    }
+}
+function writeProjectConfigFile(projectRoot, configPath, content) {
+    writeConfigFileSafely(configPath, content, () => validateProjectBootstrapConfigPathForWrite(projectRoot, configPath), 'Project config path must stay inside the project root');
+}
+function writeUserConfigFile(configPath, content) {
+    writeConfigFileSafely(configPath, content, () => validateUserConfigPathForWrite(configPath), 'User config path must stay inside the user root');
+}
+function readJsonFile(path, validateBeforeRead, errorMessage = 'Config path must stay inside the config root') {
     if (!path || !existsSync(path))
         return null;
+    validateBeforeRead?.();
+    const content = readConfigFileSafely(path, errorMessage);
     try {
-        return JSON.parse(readFileSync(path, 'utf-8'));
+        return JSON.parse(content);
     }
     catch {
         return null;
     }
 }
-function readExistingJsonFile(path, errorMessage) {
+function readExistingJsonFile(path, errorMessage, validateBeforeRead) {
     if (!existsSync(path))
         return null;
+    validateBeforeRead?.();
     try {
-        return JSON.parse(readFileSync(path, 'utf-8'));
+        return JSON.parse(readConfigFileSafely(path, errorMessage));
     }
     catch {
         throw new Error(errorMessage);
     }
 }
+function readUserJsonFile() {
+    const userPath = getUserConfigPath();
+    return readJsonFile(userPath, () => validateUserConfigPathForWrite(userPath), 'User config path must stay inside the user root');
+}
+function readProjectJsonFile(projectRoot) {
+    const projectPath = getProjectConfigPath(projectRoot);
+    return readJsonFile(projectPath, projectRoot && projectPath ? () => validateProjectBootstrapConfigPathForWrite(projectRoot, projectPath) : undefined, 'Project config path must stay inside the project root');
+}
 function ensureDir(dirPath) {
     if (!existsSync(dirPath)) {
         mkdirSync(dirPath, { recursive: true });
@@ -284,6 +468,10 @@ function isRecord(value) {
 function isSafeConfigSegment(value) {
     return /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(value) && !value.includes('..') && !value.endsWith('.');
 }
+function toSafeConfigSegment(value) {
+    const normalized = value.toLowerCase().replace(/[^a-z0-9._-]+/g, '-').replace(/^-+|-+$/g, '').replace(/\.+$/g, '');
+    return isSafeConfigSegment(normalized) ? normalized : 'workspace';
+}
 function toArtifactRemoteRepoConfig(value) {
     if (!isRecord(value) || (value.provider !== 'github' && value.provider !== 'gitlab') || typeof value.owner !== 'string' || typeof value.name !== 'string') {
         return null;
@@ -327,6 +515,15 @@ function toWorkspaceConfig(value) {
 function toWorkspaceConfigs(value) {
     return Array.isArray(value) ? value.map(toWorkspaceConfig).filter((workspace) => workspace !== null) : [];
 }
+function mergeWorkspaceConfigs(userWorkspaces, projectWorkspaces) {
+    const merged = new Map(userWorkspaces.map((workspace) => [workspace.workspaceId, workspace]));
+    for (const workspace of projectWorkspaces) {
+        if (!merged.has(workspace.workspaceId)) {
+            merged.set(workspace.workspaceId, workspace);
+        }
+    }
+    return [...merged.values()];
+}
 function toProviderModelConfig(value) {
     if (!isRecord(value))
         return {};
@@ -380,12 +577,13 @@ function toProxyConfig(value) {
         return null;
     return typeof value.httpProxy === 'string' && isValidProxyUrl(value.httpProxy) ? { httpProxy: value.httpProxy } : null;
 }
-function getProjectWritePath() {
-    const projectPath = getProjectConfigPath(findProjectRoot(process.cwd()));
-    if (!projectPath) {
+function getProjectWriteTarget() {
+    const projectRoot = findProjectRoot(process.cwd());
+    const configPath = getProjectConfigPath(projectRoot);
+    if (!projectRoot || !configPath) {
         throw new Error('Project config not found');
     }
-    return projectPath;
+    return { projectRoot, configPath };
 }
 export function containsSensitiveConfigValue(value) {
     if (Array.isArray(value)) {
@@ -432,14 +630,14 @@ function createMiniMaxProviderStatus(config) {
     };
 }
 export function getMiniMaxProviderConfig() {
-    return toMiniMaxProviderConfig(readJsonFile(getUserConfigPath())?.providers?.minimax);
+    return toMiniMaxProviderConfig(readUserJsonFile()?.providers?.minimax);
 }
 export function getMiniMaxProviderStatus() {
     return createMiniMaxProviderStatus(getMiniMaxProviderConfig());
 }
 export function setMiniMaxProviderConfig(input) {
     validateMiniMaxBaseUrl(input.baseUrl);
-    const userConfig = readJsonFile(getUserConfigPath()) ?? {};
+    const userConfig = readUserJsonFile() ?? {};
     const existingProviders = toModelProviderConfig(userConfig.providers);
     const providers = {
         ...existingProviders,
@@ -485,24 +683,23 @@ function toPeaksConfig(value) {
 export function bootstrapProjectLanguageConfig(projectRoot, language) {
     const inferredLanguage = inferHumanLanguage(language);
     const projectPath = getProjectBootstrapConfigPath(projectRoot);
-    const existing = readExistingJsonFile(projectPath, 'Project config must contain valid JSON') ?? {};
+    const existing = readExistingJsonFile(projectPath, 'Project config must contain valid JSON', () => validateProjectBootstrapConfigPathForWrite(projectRoot, projectPath)) ?? {};
     if (typeof existing.language === 'string' && existing.language.trim().length > 0) {
         return;
     }
-    validateProjectBootstrapConfigPathForWrite(projectRoot, projectPath);
-    writeFileSync(projectPath, JSON.stringify({ ...existing, language: inferredLanguage }, null, 2), 'utf-8');
+    writeProjectConfigFile(projectRoot, projectPath, JSON.stringify({ ...existing, language: inferredLanguage }, null, 2));
 }
 export function readConfig(projectRoot) {
     const detectedRoot = projectRoot ?? findProjectRoot(process.cwd());
-    const userPath = getUserConfigPath();
-    const projectPath = getProjectConfigPath(detectedRoot);
-    const userConfig = toPeaksConfig(readJsonFile(userPath));
-    const projectConfig = removeProjectSensitiveConfig(toPeaksConfig(readJsonFile(projectPath)));
-    const { proxy: projectProxy, ...projectConfigWithoutProxy } = projectConfig;
+    const userConfig = toPeaksConfig(readUserJsonFile());
+    const projectConfig = removeProjectSensitiveConfig(toPeaksConfig(readProjectJsonFile(detectedRoot)));
+    const { proxy: projectProxy, workspaces: projectWorkspaces, ...projectConfigWithoutProxy } = projectConfig;
+    const userWorkspaces = userConfig.workspaces ?? [];
     return {
         ...DEFAULT_CONFIG,
         ...userConfig,
-        ...projectConfigWithoutProxy
+        ...projectConfigWithoutProxy,
+        workspaces: mergeWorkspaceConfigs(userWorkspaces, projectWorkspaces ?? [])
     };
 }
 export function writeConfig(partial, layer = 'user') {
@@ -515,27 +712,33 @@ export function writeConfig(partial, layer = 'user') {
     validateProviderConfig(partial);
     validateProxyConfig(partial);
     if (layer === 'project') {
-        const projectPath = getProjectWritePath();
-        ensureDir(dirname(projectPath));
-        const existing = readJsonFile(projectPath) ?? {};
+        const { projectRoot, configPath } = getProjectWriteTarget();
+        ensureDir(dirname(configPath));
+        const existing = readJsonFile(configPath, () => validateProjectBootstrapConfigPathForWrite(projectRoot, configPath)) ?? {};
         const merged = { ...existing, ...partial };
-        writeFileSync(projectPath, JSON.stringify(merged, null, 2), 'utf-8');
+        writeProjectConfigFile(projectRoot, configPath, JSON.stringify(merged, null, 2));
         return;
     }
     const userPath = getUserConfigPath();
     ensureDir(dirname(userPath));
-    const userPathDir = dirname(userPath);
-    ensureDir(userPathDir);
-    const existing = readJsonFile(userPath) ?? {};
+    const existing = readJsonFile(userPath, () => validateUserConfigPathForWrite(userPath)) ?? {};
     const merged = { ...existing, ...partial };
-    writeFileSync(userPath, JSON.stringify(merged, null, 2), 'utf-8');
+    writeUserConfigFile(userPath, JSON.stringify(merged, null, 2));
 }
 export function getConfig(options = {}) {
     const projectRoot = findProjectRoot(process.cwd());
-    const userConfig = readJsonFile(getUserConfigPath()) ?? {};
-    const projectConfig = removeProjectSensitiveConfig(readJsonFile(getProjectConfigPath(projectRoot)) ?? {});
-    const { proxy: projectProxy, ...projectConfigWithoutProxy } = projectConfig;
-    const source = options.layer === 'user' ? userConfig : options.layer === 'project' ? projectConfig : { ...userConfig, ...projectConfigWithoutProxy };
+    const userConfig = readUserJsonFile() ?? {};
+    const projectConfig = removeProjectSensitiveConfig(readProjectJsonFile(projectRoot) ?? {});
+    const { proxy: projectProxy, workspaces: projectWorkspaces, ...projectConfigWithoutProxy } = projectConfig;
+    const source = options.layer === 'user'
+        ? userConfig
+        : options.layer === 'project'
+            ? projectConfig
+            : {
+                ...userConfig,
+                ...projectConfigWithoutProxy,
+                workspaces: mergeWorkspaceConfigs(toWorkspaceConfigs(userConfig.workspaces), toWorkspaceConfigs(projectWorkspaces))
+            };
     const config = isRecord(source) ? { ...source, ...(source.tokens !== undefined ? { tokens: toTokenConfig(source.tokens) } : {}) } : source;
     if (options.key !== undefined) {
         return getNestedValue(config, options.key);
@@ -564,12 +767,21 @@ export function setConfig(options) {
         }
     }
     validateProxyUrl(getProxyUrlCandidate(options.key, options.value));
-    const targetPath = layer === 'project' ? getProjectWritePath() : getUserConfigPath();
+    const projectTarget = layer === 'project' ? getProjectWriteTarget() : null;
+    const targetPath = projectTarget?.configPath ?? getUserConfigPath();
     ensureDir(dirname(targetPath));
-    const existing = readJsonFile(targetPath) ?? {};
+    const existing = projectTarget
+        ? readJsonFile(targetPath, () => validateProjectBootstrapConfigPathForWrite(projectTarget.projectRoot, targetPath)) ?? {}
+        : readJsonFile(targetPath, () => validateUserConfigPathForWrite(targetPath)) ?? {};
     const updated = { ...existing };
     setNestedValue(updated, options.key, options.value);
-    writeFileSync(targetPath, JSON.stringify(updated, null, 2), 'utf-8');
+    const content = JSON.stringify(updated, null, 2);
+    if (projectTarget) {
+        writeProjectConfigFile(projectTarget.projectRoot, targetPath, content);
+    }
+    else {
+        writeUserConfigFile(targetPath, content);
+    }
 }
 export function getWorkspaceConfig(workspaceId, projectRoot) {
     const config = readConfig(projectRoot ?? findProjectRoot(process.cwd()));
@@ -626,3 +838,77 @@ export function getCurrentWorkspaceConfig() {
         return null;
     return getWorkspaceConfig(config.currentWorkspace);
 }
+export function getWorkspaceConfigForPath(path = process.cwd()) {
+    const config = readConfig(findProjectRoot(path));
+    return findWorkspaceForPath(config.workspaces, path);
+}
+function createWorkspaceId(projectRoot, existingIds) {
+    const base = toSafeConfigSegment(basename(projectRoot));
+    if (!existingIds.has(base))
+        return base;
+    let suffix = 2;
+    while (existingIds.has(`${base}-${suffix}`)) {
+        suffix += 1;
+    }
+    return `${base}-${suffix}`;
+}
+function findWorkspaceForPath(workspaces, path) {
+    const targetPath = stablePath(path);
+    const matches = workspaces.flatMap((workspace) => {
+        if (!isAbsolute(workspace.rootPath) || !existsSync(workspace.rootPath))
+            return [];
+        const rootPath = stablePath(workspace.rootPath);
+        return isInsidePath(targetPath, rootPath) ? [{ workspace, rootPath }] : [];
+    });
+    if (matches.length === 0)
+        return null;
+    return matches.reduce((best, match) => match.rootPath.length > best.rootPath.length ? match : best).workspace;
+}
+function getWorkspaceArtifactRoot(workspace) {
+    return workspace.artifactStorage?.localPath ? resolve(workspace.artifactStorage.localPath) : resolve(homedir(), '.peaks', 'workspaces', workspace.workspaceId, 'artifacts');
+}
+function ensureArtifactWorkspaceMarker(workspace) {
+    const artifactRoot = getWorkspaceArtifactRoot(workspace);
+    const peaksPath = resolve(artifactRoot, '.peaks');
+    const markerPath = resolve(peaksPath, 'config.json');
+    ensureDir(artifactRoot);
+    validateArtifactWorkspaceRoot(artifactRoot, workspace.rootPath);
+    ensureDir(peaksPath);
+    validateArtifactWorkspaceMarkerPath(artifactRoot, peaksPath, markerPath);
+    if (!existsSync(markerPath)) {
+        writeConfigFileSafely(markerPath, '{}\n', () => validateArtifactWorkspaceMarkerPath(artifactRoot, peaksPath, markerPath), 'Artifact workspace marker must stay inside the artifact workspace');
+    }
+}
+export function ensureWorkspaceConfigForPath(path = process.cwd()) {
+    const projectRoot = resolveProjectRootForConfig(path);
+    if (!isAbsolute(projectRoot) || !existsSync(projectRoot))
+        return null;
+    const config = readLayerConfig('user');
+    const existingWorkspace = findWorkspaceForPath(config.workspaces, path);
+    if (existingWorkspace) {
+        ensureArtifactWorkspaceMarker(existingWorkspace);
+        if (!config.currentWorkspace) {
+            writeConfig({ currentWorkspace: existingWorkspace.workspaceId }, 'user');
+        }
+        return existingWorkspace;
+    }
+    const existingIds = new Set(config.workspaces.map((workspace) => workspace.workspaceId));
+    const workspaceId = createWorkspaceId(projectRoot, existingIds);
+    const workspace = {
+        workspaceId,
+        name: basename(projectRoot) || 'Workspace',
+        rootPath: stablePath(projectRoot),
+        artifactStorage: { mode: 'local', localPath: resolve(homedir(), '.peaks', 'workspaces', workspaceId, 'artifacts') },
+        installedCapabilityIds: []
+    };
+    ensureArtifactWorkspaceMarker(workspace);
+    const updatedWorkspaces = [...config.workspaces, workspace];
+    writeConfig({ workspaces: updatedWorkspaces, ...(!config.currentWorkspace ? { currentWorkspace: workspace.workspaceId } : {}) }, 'user');
+    return workspace;
+}
+export function getWorkspaceConfigForCurrentPath() {
+    return getWorkspaceConfigForPath(process.cwd());
+}
+export function ensureWorkspaceConfigForCurrentPath() {
+    return ensureWorkspaceConfigForPath(process.cwd());
+}

package/dist/src/services/config/config-types.js

@@ -1,5 +1,6 @@
+import { CLI_VERSION } from '../../shared/version.js';
 export const DEFAULT_CONFIG = {
-    version: '0.1.0',
+    version: CLI_VERSION,
     currentWorkspace: null,
     workspaces: [],
     language: 'en',

package/dist/src/shared/path-utils.d.ts

@@ -1,5 +1,5 @@
 import { type Platform } from './platform.js';
-export declare const SEP: "/" | "\\";
+export declare const SEP: "\\" | "/";
 export declare function normalizePath(p: string): string;
 export declare function pathsEqual(a: string, b: string): boolean;
 export declare function localPath(p: string, targetPlatform?: Platform): string;

package/dist/src/shared/version.d.ts

@@ -1 +1 @@
-export declare const CLI_VERSION = "1.0.7";
+export declare const CLI_VERSION = "1.0.9";

package/dist/src/shared/version.js

@@ -1 +1 @@
-export const CLI_VERSION = "1.0.7";
+export const CLI_VERSION = "1.0.9";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "peaks-cli",
-  "version": "1.0.7",
+  "version": "1.0.9",
   "description": "Peaks CLI and short skill family for Claude Code automation.",
   "author": "SquabbyZ",
   "license": "MIT",

package/scripts/install-skills.mjs

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
-import { closeSync, constants, copyFileSync, existsSync, fchmodSync, fstatSync, ftruncateSync, lstatSync, mkdirSync, openSync, readFileSync, readlinkSync, realpathSync, readdirSync, symlinkSync, unlinkSync, writeFileSync } from 'node:fs';
+import { closeSync, constants, existsSync, fchmodSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readlinkSync, realpathSync, readdirSync, renameSync, symlinkSync, unlinkSync, writeFileSync } from 'node:fs';
+import { createHash, randomUUID } from 'node:crypto';
 import { homedir } from 'node:os';
-import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 function getPathStats(path) {
@@ -16,31 +17,163 @@ function isBrokenSymlink(stats, targetPath) {
   return stats.isSymbolicLink() && !existsSync(targetPath);
 }
 
+function validateManagedMarkerPath(markerPath) {
+  const markerStats = getPathStats(markerPath);
+  if (!markerStats) return;
+  if (markerStats.isSymbolicLink()) {
+    throw new Error('Peaks managed marker path must not be a symlink');
+  }
+  if (!markerStats.isFile()) {
+    throw new Error('Peaks managed marker path must be a file');
+  }
+  if (markerStats.nlink !== 1) {
+    throw new Error('Peaks managed marker path must not be hardlinked');
+  }
+}
+
+function validateOpenFile(fd, path, errorMessage) {
+  const fdStats = fstatSync(fd);
+  const pathStats = lstatSync(path);
+  if (!fdStats.isFile() || !pathStats.isFile() || fdStats.dev !== pathStats.dev || fdStats.ino !== pathStats.ino) {
+    throw new Error(errorMessage);
+  }
+  if (fdStats.nlink !== 1 || pathStats.nlink !== 1) {
+    throw new Error(`${errorMessage}: hardlinked file`);
+  }
+}
+
+function createFileIdentity(path) {
+  const stats = lstatSync(path);
+  if (!stats.isFile() || stats.isSymbolicLink() || stats.nlink !== 1) {
+    return null;
+  }
+  return { dev: stats.dev, ino: stats.ino };
+}
+
+function isSameFileIdentity(path, identity) {
+  if (identity === null) return false;
+  const stats = getPathStats(path);
+  return Boolean(stats?.isFile() && !stats.isSymbolicLink() && stats.nlink === 1 && stats.dev === identity.dev && stats.ino === identity.ino);
+}
+
+function getSafeReadOpenFlags() {
+  return typeof constants.O_NOFOLLOW === 'number' ? constants.O_RDONLY | constants.O_NOFOLLOW : constants.O_RDONLY;
+}
+
+function readFileSafely(path, errorMessage) {
+  const fd = openSync(path, getSafeReadOpenFlags());
+  try {
+    validateOpenFile(fd, path, errorMessage);
+    return readFileSync(fd, 'utf8');
+  } finally {
+    closeSync(fd);
+  }
+}
+
 function getManagedTarget(targetPath) {
   const markerPath = `${targetPath}.peaks-managed`;
+  validateManagedMarkerPath(markerPath);
   if (!existsSync(markerPath)) {
     return null;
   }
-  return readFileSync(markerPath, 'utf8').trim();
+  return readFileSafely(markerPath, 'Peaks managed marker path changed during read').trim();
 }
 
 function markManagedPeaksLink(targetPath, sourcePath) {
   const markerPath = `${targetPath}.peaks-managed`;
-  writeFileSync(markerPath, `${sourcePath}\n`, 'utf8');
+  validateManagedMarkerPath(markerPath);
+  writeFileAtomically(markerPath, `${sourcePath}\n`, 'Peaks managed marker path changed during write', () => validateManagedMarkerPath(markerPath));
+}
+
+function readPackageSourceFile(path) {
+  const stats = lstatSync(path);
+  if (!stats.isFile() || stats.isSymbolicLink()) {
+    throw new Error('Peaks package source path must be a file');
+  }
+  return readFileSync(path, 'utf8');
+}
+
+function hashContent(content) {
+  return createHash('sha256').update(content).digest('hex');
+}
+
+function hashFileContent(path) {
+  return hashContent(readFileSafely(path, 'Peaks managed file path changed during read'));
+}
+
+function createManagedOutputStyleMarker(sourcePath, outputStyleName) {
+  const content = readPackageSourceFile(sourcePath);
+  return `${JSON.stringify({ version: 1, kind: 'output-style', outputStyleName, sourcePath, contentSha256: hashContent(content) })}\n`;
+}
+
+function parseManagedOutputStyleMarker(managedTarget) {
+  if (managedTarget === null) return null;
+  try {
+    const marker = JSON.parse(managedTarget);
+    if (marker?.version !== 1 || marker?.kind !== 'output-style' || typeof marker.outputStyleName !== 'string' || typeof marker.sourcePath !== 'string' || typeof marker.contentSha256 !== 'string') {
+      return null;
+    }
+    return marker;
+  } catch {
+    return null;
+  }
+}
+
+function isTrustedOutputStyleSource(marker, sourcePath, outputStyleName) {
+  return marker.outputStyleName === outputStyleName && resolve(marker.sourcePath) === resolve(sourcePath) && basename(resolve(marker.sourcePath)) === outputStyleName;
+}
+
+function getManagedPeaksOutputStyleIdentity(managedTarget, targetPath, sourcePath, outputStyleName) {
+  const marker = parseManagedOutputStyleMarker(managedTarget);
+  const sourceHash = hashContent(readPackageSourceFile(sourcePath));
+  if (marker === null || !isTrustedOutputStyleSource(marker, sourcePath, outputStyleName) || !existsSync(targetPath) || hashFileContent(targetPath) !== sourceHash || marker.contentSha256 !== sourceHash) {
+    return null;
+  }
+  return createFileIdentity(targetPath);
+}
+
+function validateInstallRoot(targetRoot, label) {
+  const rootStats = lstatSync(targetRoot);
+  if (rootStats.isSymbolicLink()) {
+    throw new Error(`${label} install root must not be a symlink`);
+  }
+  if (!rootStats.isDirectory()) {
+    throw new Error(`${label} install root must be a directory`);
+  }
+  return rootStats;
 }
 
-function isManagedPeaksOutputStyle(managedTarget, outputStyleName) {
-  if (managedTarget === null) return false;
-  return managedTarget.replaceAll('\\', '/').endsWith(`/output-styles/${outputStyleName}`);
+function createInstallRootValidator(targetRoot, label) {
+  const expectedStats = validateInstallRoot(targetRoot, label);
+  return () => {
+    const rootStats = validateInstallRoot(targetRoot, label);
+    if (rootStats.dev !== expectedStats.dev || rootStats.ino !== expectedStats.ino) {
+      throw new Error(`${label} install root changed during write`);
+    }
+  };
 }
 
 function createInstallResult() {
   return { installed: [], skipped: [] };
 }
 
-const PROJECT_CONFIG_DEFAULTS = {
-  version: '0.1.0',
-  currentWorkspace: null,
+function resolvePackageRoot(options = {}) {
+  return resolve(options.packageRoot ?? join(dirname(fileURLToPath(import.meta.url)), '..'));
+}
+
+function readPackageVersion(packageRoot = resolvePackageRoot()) {
+  const packageJson = JSON.parse(readFileSync(join(packageRoot, 'package.json'), 'utf8'));
+  if (typeof packageJson.version !== 'string' || packageJson.version.length === 0) {
+    throw new Error('package.json version must be a non-empty string');
+  }
+
+  return packageJson.version;
+}
+
+function createConfigDefaults(packageRoot) {
+  return {
+    version: readPackageVersion(packageRoot),
+    currentWorkspace: null,
   workspaces: [],
   language: 'en',
   model: 'sonnet',
@@ -52,8 +185,9 @@ const PROJECT_CONFIG_DEFAULTS = {
       model: 'minimax-2.7'
     }
   },
-  proxy: {}
-};
+    proxy: {}
+  };
+}
 
 function createConfigResult(overrides = {}) {
   return { created: false, updated: false, skipped: false, ...overrides };
@@ -89,7 +223,7 @@ function readConfigFile(configPath, label) {
   }
 
   try {
-    const parsed = JSON.parse(readFileSync(configPath, 'utf8'));
+    const parsed = JSON.parse(readFileSafely(configPath, `${label} config path changed during read`));
     if (!isPlainObject(parsed)) {
       throw new Error(`${label} config must contain a JSON object`);
     }
@@ -117,6 +251,9 @@ function validateConfigPath(root, peaksRoot, configPath, label) {
     throw new Error(`${label} config path must be a file`);
   }
   if (configStats) {
+    if (configStats.nlink !== 1) {
+      throw new Error(`${label} config path must not be hardlinked`);
+    }
     const configReal = realpathSync(configPath);
     if (!isInsidePath(configReal, rootReal) || !isInsidePath(configReal, peaksReal)) {
       throw new Error(`${label} config path must stay inside the ${label.toLowerCase()} root`);
@@ -132,41 +269,93 @@ function validateUserConfigPaths(userRoot, peaksRoot, configPath) {
   validateConfigPath(userRoot, peaksRoot, configPath, 'User');
 }
 
-function validateOpenConfigFile(fd, configPath, label) {
-  const fdStats = fstatSync(fd);
-  const pathStats = lstatSync(configPath);
-  if (!fdStats.isFile() || !pathStats.isFile() || fdStats.dev !== pathStats.dev || fdStats.ino !== pathStats.ino) {
-    throw new Error(`${label} config path changed during write`);
-  }
-  if (fdStats.nlink !== 1 || pathStats.nlink !== 1) {
-    throw new Error(`${label} config path must not be hardlinked`);
-  }
+function getSafeTempOpenFlags() {
+  const baseFlags = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL;
+  return typeof constants.O_NOFOLLOW === 'number' ? baseFlags | constants.O_NOFOLLOW : baseFlags;
 }
 
-function writeConfigFile(configPath, content, label, validateBeforeWrite) {
+function writeFileExclusively(path, content, errorMessage, validateBeforeWrite) {
   validateBeforeWrite();
-  if (typeof constants.O_NOFOLLOW !== 'number') {
-    throw new Error('Safe config writes require O_NOFOLLOW support');
+  let fd = openSync(path, getSafeTempOpenFlags(), 0o600);
+  let closeError = null;
+  let identity = null;
+  try {
+    validateOpenFile(fd, path, errorMessage);
+    validateBeforeWrite();
+    validateOpenFile(fd, path, errorMessage);
+    identity = createFileIdentity(path);
+    if (identity === null) {
+      throw new Error(errorMessage);
+    }
+    fchmodSync(fd, 0o600);
+    writeFileSync(fd, content, 'utf8');
+    const writeFd = fd;
+    fd = null;
+    closeSync(writeFd);
+    return identity;
+  } finally {
+    if (fd !== null) {
+      try {
+        closeSync(fd);
+      } catch (error) {
+        closeError = error;
+      }
+    }
+    if (closeError) {
+      throw closeError;
+    }
   }
+}
+
+function writeFileAtomically(configPath, content, errorMessage, validateBeforeWrite) {
+  validateBeforeWrite();
 
-  const fd = openSync(configPath, constants.O_WRONLY | constants.O_CREAT | constants.O_NOFOLLOW, 0o600);
+  const tempPath = `${configPath}.${process.pid}.${randomUUID()}.tmp`;
+  let fd = openSync(tempPath, getSafeTempOpenFlags(), 0o600);
+  let renamed = false;
+  let closeError = null;
   try {
-    validateBeforeWrite();
-    validateOpenConfigFile(fd, configPath, label);
+    validateOpenFile(fd, tempPath, errorMessage);
     fchmodSync(fd, 0o600);
-    ftruncateSync(fd, 0);
     writeFileSync(fd, content, 'utf8');
+    const writeFd = fd;
+    fd = null;
+    closeSync(writeFd);
+    validateBeforeWrite();
+    const readFd = openSync(tempPath, getSafeReadOpenFlags());
+    try {
+      validateOpenFile(readFd, tempPath, errorMessage);
+    } finally {
+      closeSync(readFd);
+    }
+    renameSync(tempPath, configPath);
+    renamed = true;
   } finally {
-    closeSync(fd);
+    if (fd !== null) {
+      try {
+        closeSync(fd);
+      } catch (error) {
+        closeError = error;
+      }
+    }
+    try {
+      if (!renamed && existsSync(tempPath)) {
+        unlinkSync(tempPath);
+      }
+    } finally {
+      if (closeError) {
+        throw closeError;
+      }
+    }
   }
 }
 
 function writeProjectConfig(projectRoot, peaksRoot, configPath, content) {
-  writeConfigFile(configPath, content, 'Project', () => validateProjectConfigPaths(projectRoot, peaksRoot, configPath));
+  writeFileAtomically(configPath, content, 'Project config path changed during write', () => validateProjectConfigPaths(projectRoot, peaksRoot, configPath));
 }
 
 function writeUserConfig(userRoot, peaksRoot, configPath, content) {
-  writeConfigFile(configPath, content, 'User', () => validateUserConfigPaths(userRoot, peaksRoot, configPath));
+  writeFileAtomically(configPath, content, 'User config path changed during write', () => validateUserConfigPaths(userRoot, peaksRoot, configPath));
 }
 
 function resolveProjectRoot(options) {
@@ -174,9 +363,9 @@ function resolveProjectRoot(options) {
   return projectRoot ? resolve(projectRoot) : null;
 }
 
-function writeMergedConfig(configPath, label, writeConfig) {
+function writeMergedConfig(configPath, label, defaults, writeConfig) {
   const existing = readConfigFile(configPath, label);
-  const next = existing === null ? PROJECT_CONFIG_DEFAULTS : mergeMissingConfigValues(existing, PROJECT_CONFIG_DEFAULTS);
+  const next = { ...(existing === null ? defaults : mergeMissingConfigValues(existing, defaults)), version: defaults.version };
   const currentJson = existing === null ? null : `${JSON.stringify(existing, null, 2)}\n`;
   const nextJson = `${JSON.stringify(next, null, 2)}\n`;
 
@@ -205,7 +394,7 @@ export function installUserConfig(options = {}) {
   }
   validateUserConfigPaths(userRoot, peaksRoot, configPath);
 
-  return writeMergedConfig(configPath, 'User', (content) => writeUserConfig(userRoot, peaksRoot, configPath, content));
+  return writeMergedConfig(configPath, 'User', createConfigDefaults(options.packageRoot), (content) => writeUserConfig(userRoot, peaksRoot, configPath, content));
 }
 
 export function installProjectConfig(options = {}) {
@@ -229,11 +418,11 @@ export function installProjectConfig(options = {}) {
   }
   validateProjectConfigPaths(projectRoot, peaksRoot, configPath);
 
-  return writeMergedConfig(configPath, 'Project', (content) => writeProjectConfig(projectRoot, peaksRoot, configPath, content));
+  return writeMergedConfig(configPath, 'Project', createConfigDefaults(options.packageRoot), (content) => writeProjectConfig(projectRoot, peaksRoot, configPath, content));
 }
 
 export function installBundledSkills(options = {}) {
-  const packageRoot = resolve(options.packageRoot ?? join(dirname(fileURLToPath(import.meta.url)), '..'));
+  const packageRoot = resolvePackageRoot(options);
   const skillsRoot = join(packageRoot, 'skills');
   const targetRoot = resolve(options.targetRoot ?? process.env.PEAKS_CLAUDE_SKILLS_DIR ?? join(homedir(), '.claude', 'skills'));
 
@@ -244,6 +433,7 @@ export function installBundledSkills(options = {}) {
   const installed = [];
   const skipped = [];
   mkdirSync(targetRoot, { recursive: true });
+  const validateSkillsRoot = createInstallRootValidator(targetRoot, 'Peaks skills');
 
   for (const skillName of readdirSync(skillsRoot)) {
     const sourcePath = join(skillsRoot, skillName);
@@ -257,12 +447,15 @@ export function installBundledSkills(options = {}) {
     const current = getPathStats(targetPath);
     if (current) {
       const managedTarget = getManagedTarget(targetPath);
-      if (current.isSymbolicLink() && readlinkSync(targetPath) === sourcePath) {
+      const linkTarget = current.isSymbolicLink() ? readlinkSync(targetPath) : null;
+      if (linkTarget === sourcePath) {
         installed.push(skillName);
         continue;
       }
-      if (isBrokenSymlink(current, targetPath) && managedTarget === readlinkSync(targetPath)) {
+      if ((current.isSymbolicLink() || isBrokenSymlink(current, targetPath)) && managedTarget === linkTarget) {
+        validateSkillsRoot();
         unlinkSync(targetPath);
+        validateSkillsRoot();
         unlinkSync(`${targetPath}.peaks-managed`);
       } else {
         skipped.push(skillName);
@@ -270,8 +463,19 @@ export function installBundledSkills(options = {}) {
       }
     }
 
+    validateSkillsRoot();
     symlinkSync(sourcePath, targetPath, process.platform === 'win32' ? 'junction' : 'dir');
-    markManagedPeaksLink(targetPath, sourcePath);
+    try {
+      validateSkillsRoot();
+      markManagedPeaksLink(targetPath, sourcePath);
+    } catch (error) {
+      validateSkillsRoot();
+      const created = getPathStats(targetPath);
+      if (created?.isSymbolicLink() && readlinkSync(targetPath) === sourcePath) {
+        unlinkSync(targetPath);
+      }
+      throw error;
+    }
     installed.push(skillName);
   }
 
@@ -279,7 +483,7 @@ export function installBundledSkills(options = {}) {
 }
 
 export function installBundledOutputStyles(options = {}) {
-  const packageRoot = resolve(options.packageRoot ?? join(dirname(fileURLToPath(import.meta.url)), '..'));
+  const packageRoot = resolvePackageRoot(options);
   const outputStylesRoot = join(packageRoot, 'output-styles');
   const targetRoot = resolve(options.targetRoot ?? process.env.PEAKS_CLAUDE_OUTPUT_STYLES_DIR ?? join(homedir(), '.claude', 'output-styles'));
 
@@ -290,6 +494,7 @@ export function installBundledOutputStyles(options = {}) {
   const installed = [];
   const skipped = [];
   mkdirSync(targetRoot, { recursive: true });
+  const validateOutputStylesRoot = createInstallRootValidator(targetRoot, 'Peaks output styles');
 
   for (const outputStyleName of readdirSync(outputStylesRoot)) {
     const sourcePath = join(outputStylesRoot, outputStyleName);
@@ -302,8 +507,14 @@ export function installBundledOutputStyles(options = {}) {
     const current = getPathStats(targetPath);
     if (current) {
       const managedTarget = getManagedTarget(targetPath);
-      if (isManagedPeaksOutputStyle(managedTarget, outputStyleName)) {
+      const managedTargetIdentity = getManagedPeaksOutputStyleIdentity(managedTarget, targetPath, sourcePath, outputStyleName);
+      if (isSameFileIdentity(targetPath, managedTargetIdentity)) {
+        validateOutputStylesRoot();
+        if (!isSameFileIdentity(targetPath, managedTargetIdentity)) {
+          throw new Error('Peaks output style path changed during unlink');
+        }
         unlinkSync(targetPath);
+        validateOutputStylesRoot();
         unlinkSync(`${targetPath}.peaks-managed`);
       } else {
         skipped.push(outputStyleName);
@@ -311,8 +522,25 @@ export function installBundledOutputStyles(options = {}) {
       }
     }
 
-    copyFileSync(sourcePath, targetPath);
-    markManagedPeaksLink(targetPath, sourcePath);
+    const markerPath = `${targetPath}.peaks-managed`;
+    validateManagedMarkerPath(markerPath);
+    if (!current && existsSync(markerPath)) {
+      validateOutputStylesRoot();
+      unlinkSync(markerPath);
+    }
+    const createdTargetIdentity = writeFileExclusively(targetPath, readPackageSourceFile(sourcePath), 'Peaks output style path changed during write', validateOutputStylesRoot);
+    try {
+      writeFileExclusively(markerPath, createManagedOutputStyleMarker(sourcePath, outputStyleName), 'Peaks managed marker path changed during write', () => {
+        validateOutputStylesRoot();
+        validateManagedMarkerPath(markerPath);
+      });
+    } catch (error) {
+      validateOutputStylesRoot();
+      if (isSameFileIdentity(targetPath, createdTargetIdentity)) {
+        unlinkSync(targetPath);
+      }
+      throw error;
+    }
     installed.push(outputStyleName);
   }