pi-extmgr 0.1.13 → 0.1.14

package/README.md

@@ -28,7 +28,7 @@ Then reload Pi.
   - Quick actions (`A`, `u`, `X`) and bulk update (`U`)
 - **Remote discovery and install**
   - npm search/browse with pagination
-  - Install by source (`npm:`, `git:`, URL, local path)
+  - Install by source (`npm:`, `git:`, `https://`, `ssh://`, `git@...`, local path)
   - Supports direct GitHub `.ts` installs and local standalone install mode
 - **Auto-update**
   - Interactive wizard (`t` in manager, or `/extensions auto-update`)
@@ -123,6 +123,8 @@ Examples:
 /extensions install npm:package-name
 /extensions install @scope/package
 /extensions install git:https://github.com/user/repo.git
+/extensions install git:git@github.com:user/repo.git
+/extensions install ssh://git@github.com/user/repo.git
 /extensions install https://github.com/user/repo/blob/main/extension.ts
 /extensions install /path/to/extension.ts
 /extensions install ./local-folder/
@@ -135,6 +137,8 @@ Examples:
   - **Managed** (npm): Auto-updates with `pi update`, stored in pi's package cache
   - **Local** (standalone): Copies to `~/.pi/agent/extensions/{package}/`, supports multi-file extensions
 - **Auto-update schedule is persistent**: `/extensions auto-update 1d` stays active across future Pi sessions and is restored when switching sessions.
+- **Settings/cache writes are hardened**: extmgr serializes writes and uses safe file replacement to reduce JSON corruption issues.
+- **Invalid JSON is handled safely**: malformed `auto-update.json` / metadata cache files are backed up and reset; invalid `.pi/settings.json` is not overwritten during package-extension toggles.
 - **Reload is built-in**: When extmgr asks to reload, it calls `ctx.reload()` directly.
 - **Remove requires restart**: After removing a package, you need to fully restart Pi (not just a reload) for it to be completely unloaded.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-extmgr",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "description": "Enhanced UX for managing local Pi extensions and community packages",
   "keywords": [
     "pi-package",

package/src/index.ts

@@ -67,11 +67,11 @@ export default function extensionsManager(pi: ExtensionAPI) {
   }
 
   async function bootstrapSession(ctx: ExtensionCommandContext | ExtensionContext): Promise<void> {
-    if (!ctx.hasUI) return;
-
     // Restore persisted auto-update config into session entries so sync lookups are valid.
     await hydrateAutoUpdateConfig(pi, ctx);
 
+    if (!ctx.hasUI) return;
+
     const getCtx: ContextProvider = () => ctx;
     startAutoUpdateTimer(pi, getCtx, createAutoUpdateNotificationHandler(ctx));
 

package/src/packages/discovery.ts

@@ -144,18 +144,7 @@ function isScopeHeader(lowerTrimmed: string, scope: "global" | "project"): boole
 }
 
 function looksLikePackageSource(source: string): boolean {
-  return (
-    source.startsWith("npm:") ||
-    source.startsWith("git:") ||
-    source.startsWith("http://") ||
-    source.startsWith("https://") ||
-    source.startsWith("/") ||
-    source.startsWith("./") ||
-    source.startsWith("../") ||
-    source.startsWith("~/") ||
-    /^[a-zA-Z]:[\\/]/.test(source) ||
-    source.startsWith("\\\\")
-  );
+  return getPackageSourceKind(source) !== "unknown";
 }
 
 function parseResolvedPathLine(line: string): string | undefined {
@@ -168,6 +157,10 @@ function parseResolvedPathLine(line: string): string | undefined {
     line.startsWith("/") ||
     line.startsWith("./") ||
     line.startsWith("../") ||
+    line.startsWith(".\\") ||
+    line.startsWith("..\\") ||
+    line.startsWith("~/") ||
+    line.startsWith("file://") ||
     /^[a-zA-Z]:[\\/]/.test(line) ||
     line.startsWith("\\\\")
   ) {

package/src/packages/extensions.ts

@@ -1,5 +1,7 @@
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir, readFile, writeFile, rename, rm } from "node:fs/promises";
 import { dirname, join, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { homedir } from "node:os";
 import { getAgentDir } from "@mariozechner/pi-coding-agent";
 import type { InstalledPackage, PackageExtensionEntry, Scope, State } from "../types/index.js";
 import { fileExists, readSummary } from "../utils/fs.js";
@@ -30,6 +32,14 @@ function toPackageRoot(pkg: InstalledPackage, cwd: string): string | undefined {
     return resolve(pkg.resolvedPath);
   }
 
+  if (pkg.source.startsWith("file://")) {
+    try {
+      return resolve(fileURLToPath(pkg.source));
+    } catch {
+      return undefined;
+    }
+  }
+
   if (
     pkg.source.startsWith("/") ||
     /^[a-zA-Z]:[\\/]/.test(pkg.source) ||
@@ -38,10 +48,19 @@ function toPackageRoot(pkg: InstalledPackage, cwd: string): string | undefined {
     return resolve(pkg.source);
   }
 
-  if (pkg.source.startsWith("./") || pkg.source.startsWith("../")) {
+  if (
+    pkg.source.startsWith("./") ||
+    pkg.source.startsWith("../") ||
+    pkg.source.startsWith(".\\") ||
+    pkg.source.startsWith("..\\")
+  ) {
     return resolve(cwd, pkg.source);
   }
 
+  if (pkg.source.startsWith("~/")) {
+    return resolve(join(homedir(), pkg.source.slice(2)));
+  }
+
   return undefined;
 }
 
@@ -52,16 +71,66 @@ function getSettingsPath(scope: Scope, cwd: string): string {
   return join(getAgentDir(), "settings.json");
 }
 
-async function readSettingsFile(path: string): Promise<SettingsFile> {
+async function readSettingsFile(
+  path: string,
+  options?: { strict?: boolean }
+): Promise<SettingsFile> {
   try {
     const raw = await readFile(path, "utf8");
-    const parsed = JSON.parse(raw) as SettingsFile;
-    return parsed && typeof parsed === "object" ? parsed : {};
-  } catch {
+    if (!raw.trim()) {
+      return {};
+    }
+
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(raw) as unknown;
+    } catch (error) {
+      if (options?.strict) {
+        throw new Error(
+          `Invalid JSON in ${path}: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+      return {};
+    }
+
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      if (options?.strict) {
+        throw new Error(`Invalid settings format in ${path}: expected a JSON object`);
+      }
+      return {};
+    }
+
+    return parsed as SettingsFile;
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return {};
+    }
+
+    if (options?.strict) {
+      throw error;
+    }
+
     return {};
   }
 }
 
+async function writeSettingsFile(path: string, settings: SettingsFile): Promise<void> {
+  const settingsDir = dirname(path);
+  await mkdir(settingsDir, { recursive: true });
+
+  const content = `${JSON.stringify(settings, null, 2)}\n`;
+  const tmpPath = `${path}.${process.pid}.${Date.now()}.tmp`;
+
+  try {
+    await writeFile(tmpPath, content, "utf8");
+    await rename(tmpPath, path);
+  } catch {
+    await writeFile(path, content, "utf8");
+  } finally {
+    await rm(tmpPath, { force: true }).catch(() => undefined);
+  }
+}
+
 function getPackageFilterState(filters: string[] | undefined, extensionPath: string): State {
   if (!filters || filters.length === 0) {
     return "enabled";
@@ -187,8 +256,7 @@ export async function setPackageExtensionState(
 ): Promise<{ ok: true } | { ok: false; error: string }> {
   try {
     const settingsPath = getSettingsPath(scope, cwd);
-    const settingsDir = dirname(settingsPath);
-    const settings = await readSettingsFile(settingsPath);
+    const settings = await readSettingsFile(settingsPath, { strict: true });
 
     const normalizedSource = normalizeSource(packageSource);
     const normalizedPath = normalizeRelativePath(extensionPath);
@@ -231,8 +299,7 @@ export async function setPackageExtensionState(
 
     settings.packages = packages;
 
-    await mkdir(settingsDir, { recursive: true });
-    await writeFile(settingsPath, `${JSON.stringify(settings, null, 2)}\n`, "utf8");
+    await writeSettingsFile(settingsPath, settings);
 
     return { ok: true };
   } catch (error) {

package/src/packages/management.ts

@@ -9,7 +9,7 @@ import {
   parseInstalledPackagesOutputAllScopes,
 } from "./discovery.js";
 import { formatInstalledPackageLabel, formatBytes, parseNpmSource } from "../utils/format.js";
-import { splitGitRepoAndRef } from "../utils/package-source.js";
+import { getPackageSourceKind, splitGitRepoAndRef } from "../utils/package-source.js";
 import { logPackageUpdate, logPackageRemove } from "../utils/history.js";
 import { notify, error as notifyError, success } from "../utils/notify.js";
 import {
@@ -53,7 +53,7 @@ async function updatePackageInternal(
 
   if (res.code !== 0) {
     const errorMsg = `Update failed: ${res.stderr || res.stdout || `exit ${res.code}`}`;
-    logPackageUpdate(pi, source, source, undefined, undefined, false, errorMsg);
+    logPackageUpdate(pi, source, source, undefined, false, errorMsg);
     notifyError(ctx, errorMsg);
     void updateExtmgrStatus(ctx, pi);
     return NO_PACKAGE_MUTATION_OUTCOME;
@@ -62,12 +62,12 @@ async function updatePackageInternal(
   const stdout = res.stdout || "";
   if (stdout.includes("already up to date") || stdout.includes("pinned")) {
     notify(ctx, `${source} is already up to date (or pinned).`, "info");
-    logPackageUpdate(pi, source, source, undefined, undefined, true);
+    logPackageUpdate(pi, source, source, undefined, true);
     void updateExtmgrStatus(ctx, pi);
     return NO_PACKAGE_MUTATION_OUTCOME;
   }
 
-  logPackageUpdate(pi, source, source, undefined, undefined, true);
+  logPackageUpdate(pi, source, source, undefined, true);
   success(ctx, `Updated ${source}`);
   void updateExtmgrStatus(ctx, pi);
 
@@ -139,8 +139,9 @@ function packageIdentity(source: string, fallbackName?: string): string {
     return `npm:${npm.name}`;
   }
 
-  if (source.startsWith("git:")) {
-    const { repo } = splitGitRepoAndRef(source.slice(4));
+  if (getPackageSourceKind(source) === "git") {
+    const gitSpec = source.startsWith("git:") ? source.slice(4) : source;
+    const { repo } = splitGitRepoAndRef(gitSpec);
     return `git:${repo}`;
   }
 

package/src/utils/auto-update.ts

@@ -50,7 +50,7 @@ export function startAutoUpdateTimer(
   const interval = getScheduleInterval(config);
   if (!interval) return;
 
-  // Check immediately if it's time
+  // Run an initial check immediately.
   void (async () => {
     const checkCtx = getCtx();
     if (!checkCtx) return;
@@ -266,13 +266,7 @@ export function enableAutoUpdate(
 
   saveAutoUpdateConfig(pi, config);
 
-  // Create a context provider that returns the current context
-  const getCtx: ContextProvider = () => {
-    // In a real implementation, this would need to be updated
-    // when the session changes. For now, we return the current context
-    // and rely on the interval checking for valid context.
-    return ctx;
-  };
+  const getCtx: ContextProvider = () => ctx;
 
   startAutoUpdateTimer(pi, getCtx, onUpdateAvailable);
 

package/src/utils/cache.ts

@@ -1,13 +1,15 @@
 /**
  * Persistent cache for package metadata to reduce npm API calls
  */
-import { readFile, writeFile, mkdir, access } from "node:fs/promises";
+import { readFile, writeFile, mkdir, access, rename, rm } from "node:fs/promises";
 import { join } from "node:path";
 import { homedir } from "node:os";
 import type { NpmPackage, InstalledPackage } from "../types/index.js";
 import { CACHE_LIMITS } from "../constants.js";
 
-const CACHE_DIR = join(homedir(), ".pi", "agent", ".extmgr-cache");
+const CACHE_DIR = process.env.PI_EXTMGR_CACHE_DIR
+  ? process.env.PI_EXTMGR_CACHE_DIR
+  : join(homedir(), ".pi", "agent", ".extmgr-cache");
 const CACHE_FILE = join(CACHE_DIR, "metadata.json");
 
 interface CachedPackageData {
@@ -31,6 +33,88 @@ interface CacheData {
 }
 
 let memoryCache: CacheData | null = null;
+let cacheWriteQueue: Promise<void> = Promise.resolve();
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+function normalizeCachedPackageEntry(key: string, value: unknown): CachedPackageData | undefined {
+  if (!isRecord(value)) return undefined;
+
+  const timestamp = value.timestamp;
+  if (typeof timestamp !== "number" || !Number.isFinite(timestamp) || timestamp <= 0) {
+    return undefined;
+  }
+
+  const name = typeof value.name === "string" && value.name.trim() ? value.name.trim() : key;
+  const entry: CachedPackageData = {
+    name,
+    timestamp,
+  };
+
+  if (typeof value.description === "string") {
+    entry.description = value.description;
+  }
+
+  if (typeof value.version === "string") {
+    entry.version = value.version;
+  }
+
+  if (typeof value.size === "number" && Number.isFinite(value.size) && value.size >= 0) {
+    entry.size = value.size;
+  }
+
+  return entry;
+}
+
+function normalizeCacheFromDisk(input: unknown): CacheData {
+  if (!isRecord(input)) {
+    return { version: 1, packages: new Map() };
+  }
+
+  const version =
+    typeof input.version === "number" && Number.isFinite(input.version) ? input.version : 1;
+
+  const packages = new Map<string, CachedPackageData>();
+  const rawPackages = isRecord(input.packages) ? input.packages : {};
+
+  for (const [name, value] of Object.entries(rawPackages)) {
+    const normalized = normalizeCachedPackageEntry(name, value);
+    if (normalized) {
+      packages.set(name, normalized);
+    }
+  }
+
+  let lastSearch: CacheData["lastSearch"];
+  if (isRecord(input.lastSearch)) {
+    const query = input.lastSearch.query;
+    const timestamp = input.lastSearch.timestamp;
+    const results = input.lastSearch.results;
+
+    if (
+      typeof query === "string" &&
+      typeof timestamp === "number" &&
+      Number.isFinite(timestamp) &&
+      Array.isArray(results)
+    ) {
+      const normalizedResults = results.filter(
+        (value): value is string => typeof value === "string"
+      );
+      lastSearch = {
+        query,
+        timestamp,
+        results: normalizedResults,
+      };
+    }
+  }
+
+  return {
+    version,
+    packages,
+    lastSearch,
+  };
+}
 
 /**
  * Ensure cache directory exists
@@ -43,6 +127,18 @@ async function ensureCacheDir(): Promise<void> {
   }
 }
 
+async function backupCorruptCacheFile(): Promise<void> {
+  const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+  const backupPath = join(CACHE_DIR, `metadata.invalid-${stamp}.json`);
+
+  try {
+    await rename(CACHE_FILE, backupPath);
+    console.warn(`[extmgr] Invalid metadata cache JSON. Backed up to ${backupPath}.`);
+  } catch (error) {
+    console.warn("[extmgr] Failed to backup invalid cache file:", error);
+  }
+}
+
 /**
  * Load cache from disk
  */
@@ -52,21 +148,29 @@ async function loadCache(): Promise<CacheData> {
   try {
     await ensureCacheDir();
     const data = await readFile(CACHE_FILE, "utf8");
-    const parsed = JSON.parse(data) as {
-      version: number;
-      packages: Record<string, CachedPackageData>;
-      lastSearch?: CacheData["lastSearch"];
-    };
+    const trimmed = data.trim();
+
+    if (!trimmed) {
+      memoryCache = {
+        version: 1,
+        packages: new Map(),
+      };
+      return memoryCache;
+    }
 
-    memoryCache = {
-      version: parsed.version,
-      packages: new Map(Object.entries(parsed.packages)),
-      lastSearch: parsed.lastSearch ?? undefined,
-    };
+    try {
+      const parsed = JSON.parse(trimmed) as unknown;
+      memoryCache = normalizeCacheFromDisk(parsed);
+    } catch {
+      await backupCorruptCacheFile();
+      memoryCache = {
+        version: 1,
+        packages: new Map(),
+      };
+    }
   } catch (error) {
-    // Cache doesn't exist or is corrupted, start fresh
+    // Cache doesn't exist or is unreadable, start fresh
     if (error instanceof Error && "code" in error && error.code !== "ENOENT") {
-      // Only log actual errors, not missing file
       console.warn("[extmgr] Cache load failed, resetting:", error.message);
     }
     memoryCache = {
@@ -84,24 +188,43 @@ async function loadCache(): Promise<CacheData> {
 async function saveCache(): Promise<void> {
   if (!memoryCache) return;
 
-  try {
-    await ensureCacheDir();
-    const data: {
-      version: number;
-      packages: Record<string, CachedPackageData>;
-      lastSearch?: { query: string; results: string[]; timestamp: number } | undefined;
-    } = {
-      version: memoryCache.version,
-      packages: Object.fromEntries(memoryCache.packages),
-      lastSearch: memoryCache.lastSearch,
-    };
+  await ensureCacheDir();
 
-    await writeFile(CACHE_FILE, JSON.stringify(data, null, 2), "utf8");
-  } catch (error) {
-    console.warn("[extmgr] Cache save failed:", error instanceof Error ? error.message : error);
+  const data: {
+    version: number;
+    packages: Record<string, CachedPackageData>;
+    lastSearch?: { query: string; results: string[]; timestamp: number } | undefined;
+  } = {
+    version: memoryCache.version,
+    packages: Object.fromEntries(memoryCache.packages),
+    lastSearch: memoryCache.lastSearch,
+  };
+
+  const content = `${JSON.stringify(data, null, 2)}\n`;
+  const tmpPath = join(CACHE_DIR, `metadata.${process.pid}.${Date.now()}.tmp`);
+
+  try {
+    await writeFile(tmpPath, content, "utf8");
+    await rename(tmpPath, CACHE_FILE);
+  } catch {
+    // Fallback for filesystems where rename-overwrite can fail.
+    await writeFile(CACHE_FILE, content, "utf8");
+  } finally {
+    await rm(tmpPath, { force: true }).catch(() => undefined);
   }
 }
 
+async function enqueueCacheSave(): Promise<void> {
+  cacheWriteQueue = cacheWriteQueue
+    .catch(() => undefined)
+    .then(() => saveCache())
+    .catch((error) => {
+      console.warn("[extmgr] Cache save failed:", error instanceof Error ? error.message : error);
+    });
+
+  return cacheWriteQueue;
+}
+
 /**
  * Check if cached data is still valid (within TTL)
  */
@@ -135,7 +258,7 @@ export async function setCachedPackage(
     ...data,
     timestamp: Date.now(),
   });
-  await saveCache();
+  await enqueueCacheSave();
 }
 
 /**
@@ -191,7 +314,7 @@ export async function setCachedSearch(query: string, packages: NpmPackage[]): Pr
     timestamp: Date.now(),
   };
 
-  await saveCache();
+  await enqueueCacheSave();
 }
 
 /**
@@ -202,7 +325,7 @@ export async function clearCache(): Promise<void> {
     version: 1,
     packages: new Map(),
   };
-  await saveCache();
+  await enqueueCacheSave();
 }
 
 /**
@@ -288,5 +411,5 @@ export async function setCachedPackageSize(name: string, size: number): Promise<
     });
   }
 
-  await saveCache();
+  await enqueueCacheSave();
 }

package/src/utils/format.ts

@@ -57,28 +57,51 @@ export function formatBytes(bytes: number): string {
   return `${parseFloat((bytes / Math.pow(k, i)).toFixed(1))} ${sizes[i]}`;
 }
 
-export function isPackageSource(str: string): boolean {
+function isGitLikeSource(source: string): boolean {
   return (
-    str.startsWith("npm:") ||
-    str.startsWith("git:") ||
-    str.startsWith("http") ||
-    str.startsWith("/") ||
-    str.startsWith("./") ||
-    str.startsWith("../")
+    source.startsWith("git:") ||
+    source.startsWith("http://") ||
+    source.startsWith("https://") ||
+    source.startsWith("ssh://") ||
+    source.startsWith("git://") ||
+    /^git@[^\s:]+:.+/.test(source)
   );
 }
 
-export function normalizePackageSource(source: string): string {
-  if (
-    source.startsWith("npm:") ||
-    source.startsWith("git:") ||
-    source.startsWith("http") ||
+function isLocalPathSource(source: string): boolean {
+  return (
     source.startsWith("/") ||
-    source.startsWith(".")
-  ) {
-    return source;
+    source.startsWith("./") ||
+    source.startsWith("../") ||
+    source.startsWith(".\\") ||
+    source.startsWith("..\\") ||
+    source.startsWith("~/") ||
+    source.startsWith("file://") ||
+    /^[a-zA-Z]:[\\/]/.test(source) ||
+    source.startsWith("\\\\")
+  );
+}
+
+export function isPackageSource(str: string): boolean {
+  const source = str.trim();
+  if (!source) return false;
+
+  return source.startsWith("npm:") || isGitLikeSource(source) || isLocalPathSource(source);
+}
+
+export function normalizePackageSource(source: string): string {
+  const trimmed = source.trim();
+  if (!trimmed) return trimmed;
+
+  if (/^git@[^\s:]+:.+/.test(trimmed)) {
+    return `git:${trimmed}`;
+  }
+
+  if (isPackageSource(trimmed)) {
+    return trimmed;
   }
-  return `npm:${source}`;
+
+  return `npm:${trimmed}`;
 }
 
 export function parseNpmSource(

package/src/utils/history.ts

@@ -110,7 +110,6 @@ export function logPackageUpdate(
   pi: ExtensionAPI,
   source: string,
   name: string,
-  _fromVersion: string | undefined,
   toVersion: string | undefined,
   success: boolean,
   error?: string

package/src/utils/package-source.ts

@@ -30,7 +30,10 @@ export function getPackageSourceKind(source: string): PackageSourceKind {
     normalized.startsWith("/") ||
     normalized.startsWith("./") ||
     normalized.startsWith("../") ||
+    normalized.startsWith(".\\") ||
+    normalized.startsWith("..\\") ||
     normalized.startsWith("~/") ||
+    normalized.startsWith("file://") ||
     /^[a-zA-Z]:[\\/]/.test(normalized) ||
     normalized.startsWith("\\\\")
   ) {

package/src/utils/settings.ts

@@ -7,7 +7,7 @@ import type {
   ExtensionCommandContext,
   ExtensionContext,
 } from "@mariozechner/pi-coding-agent";
-import { readFile, writeFile, mkdir, access } from "node:fs/promises";
+import { readFile, writeFile, mkdir, access, rename, rm } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
@@ -32,6 +32,68 @@ const SETTINGS_DIR = process.env.PI_EXTMGR_CACHE_DIR
   : join(homedir(), ".pi", "agent", ".extmgr-cache");
 const SETTINGS_FILE = join(SETTINGS_DIR, "auto-update.json");
 
+let settingsWriteQueue: Promise<void> = Promise.resolve();
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+function sanitizeAutoUpdateConfig(input: unknown): AutoUpdateConfig {
+  if (!isRecord(input)) {
+    return { ...DEFAULT_CONFIG };
+  }
+
+  const config: AutoUpdateConfig = { ...DEFAULT_CONFIG };
+
+  const intervalMs = input.intervalMs;
+  if (typeof intervalMs === "number" && Number.isFinite(intervalMs) && intervalMs >= 0) {
+    config.intervalMs = Math.floor(intervalMs);
+  }
+
+  if (typeof input.enabled === "boolean") {
+    config.enabled = input.enabled;
+  }
+
+  if (typeof input.displayText === "string" && input.displayText.trim()) {
+    config.displayText = input.displayText.trim();
+  }
+
+  if (
+    typeof input.lastCheck === "number" &&
+    Number.isFinite(input.lastCheck) &&
+    input.lastCheck >= 0
+  ) {
+    config.lastCheck = input.lastCheck;
+  }
+
+  if (
+    typeof input.nextCheck === "number" &&
+    Number.isFinite(input.nextCheck) &&
+    input.nextCheck >= 0
+  ) {
+    config.nextCheck = input.nextCheck;
+  }
+
+  if (Array.isArray(input.updatesAvailable)) {
+    const updates = input.updatesAvailable
+      .filter((value): value is string => typeof value === "string")
+      .map((value) => value.trim())
+      .filter(Boolean);
+
+    if (updates.length > 0) {
+      config.updatesAvailable = updates;
+    }
+  }
+
+  if (!config.enabled || config.intervalMs === 0) {
+    config.enabled = false;
+    config.intervalMs = 0;
+    config.displayText = "off";
+  }
+
+  return config;
+}
+
 function getSessionConfig(
   ctx: ExtensionCommandContext | ExtensionContext
 ): AutoUpdateConfig | undefined {
@@ -43,7 +105,7 @@ function getSessionConfig(
   for (let i = entries.length - 1; i >= 0; i--) {
     const entry = entries[i];
     if (entry?.type === "custom" && entry.customType === SETTINGS_KEY && entry.data) {
-      return { ...DEFAULT_CONFIG, ...(entry.data as AutoUpdateConfig) };
+      return sanitizeAutoUpdateConfig(entry.data);
     }
   }
 
@@ -73,6 +135,20 @@ async function ensureSettingsDir(): Promise<void> {
   }
 }
 
+async function backupCorruptSettingsFile(): Promise<void> {
+  const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+  const backupPath = join(SETTINGS_DIR, `auto-update.invalid-${stamp}.json`);
+
+  try {
+    await rename(SETTINGS_FILE, backupPath);
+    console.warn(
+      `[extmgr] Invalid auto-update settings JSON. Backed up to ${backupPath} and reset to defaults.`
+    );
+  } catch (error) {
+    console.warn("[extmgr] Failed to backup invalid auto-update settings file:", error);
+  }
+}
+
 /**
  * Reads config from disk asynchronously
  */
@@ -81,9 +157,19 @@ async function readConfigFromDisk(): Promise<AutoUpdateConfig | undefined> {
     if (!(await fileExists(SETTINGS_FILE))) {
       return undefined;
     }
+
     const raw = await readFile(SETTINGS_FILE, "utf8");
-    const parsed = JSON.parse(raw) as Partial<AutoUpdateConfig>;
-    return { ...DEFAULT_CONFIG, ...parsed };
+    if (!raw.trim()) {
+      return undefined;
+    }
+
+    try {
+      const parsed = JSON.parse(raw) as unknown;
+      return sanitizeAutoUpdateConfig(parsed);
+    } catch {
+      await backupCorruptSettingsFile();
+      return undefined;
+    }
   } catch (error) {
     console.warn("[extmgr] Failed to read settings:", error);
     return undefined;
@@ -91,17 +177,34 @@ async function readConfigFromDisk(): Promise<AutoUpdateConfig | undefined> {
 }
 
 /**
- * Writes config to disk asynchronously
+ * Writes config to disk asynchronously (serialized + best-effort atomic)
  */
 async function writeConfigToDisk(config: AutoUpdateConfig): Promise<void> {
+  await ensureSettingsDir();
+
+  const content = `${JSON.stringify(config, null, 2)}\n`;
+  const tmpPath = join(SETTINGS_DIR, `auto-update.${process.pid}.${Date.now()}.tmp`);
+
   try {
-    await ensureSettingsDir();
-    await writeFile(SETTINGS_FILE, JSON.stringify(config, null, 2), "utf8");
-  } catch (error) {
-    console.warn("[extmgr] Failed to write settings:", error);
+    await writeFile(tmpPath, content, "utf8");
+    await rename(tmpPath, SETTINGS_FILE);
+  } catch {
+    // Fallback for filesystems where rename-overwrite can fail.
+    await writeFile(SETTINGS_FILE, content, "utf8");
+  } finally {
+    await rm(tmpPath, { force: true }).catch(() => undefined);
   }
 }
 
+function enqueueConfigWrite(config: AutoUpdateConfig): void {
+  settingsWriteQueue = settingsWriteQueue
+    .catch(() => undefined)
+    .then(() => writeConfigToDisk(config))
+    .catch((error) => {
+      console.warn("[extmgr] Failed to write settings:", error);
+    });
+}
+
 /**
  * Hydrate session state from persisted disk settings.
  * This ensures sync reads can still work after startup/session switch.
@@ -153,17 +256,13 @@ export function getAutoUpdateConfig(
  * Save auto-update config to session + disk.
  */
 export function saveAutoUpdateConfig(pi: ExtensionAPI, config: Partial<AutoUpdateConfig>): void {
-  const fullConfig: AutoUpdateConfig = {
+  const fullConfig = sanitizeAutoUpdateConfig({
     ...DEFAULT_CONFIG,
     ...config,
-  };
+  });
 
   pi.appendEntry(SETTINGS_KEY, fullConfig);
-
-  // Write to disk asynchronously (fire and forget)
-  writeConfigToDisk(fullConfig).catch((err) => {
-    console.warn("[extmgr] Failed to save settings:", err);
-  });
+  enqueueConfigWrite(fullConfig);
 }
 
 /**