pi-set-model 0.1.6 → 0.1.7

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.1.7 - 2026-08-29
+
+### Changed
+
+- Require Pi 0.84.4 or newer; this is the development, type-compatibility, and test baseline.
+
+### Security
+
+- Write preferences through an exclusively created, owner-only, randomly named temporary file before atomically replacing the preference file.
+
 ## 0.1.6 - 2026-08-27
 
 ### Changed

package/README.md

@@ -1,6 +1,6 @@
 # pi-set-model
 
-Remembers Pi's selected model and thinking level for each project folder. Requires Pi 0.84.1 or newer (tested with the current Pi 0.84.3 release).
+Remembers Pi's selected model and thinking level for each project folder. Requires Pi 0.84.4 or newer.
 
 After selecting a model and thinking level, explicitly save that combination for the current working directory with `/set-model set`. New Pi sessions opened in that directory restore it, rather than retaining the model selected in another project. Later thinking-level changes for the saved model automatically update the preference to match Pi's footer. A later `/model` change does not replace the saved project model unless you run `/set-model set` again.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-set-model",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "Pi extension that remembers model and thinking level per project folder",
   "type": "module",
   "private": false,

package/set-model.ts

@@ -1,7 +1,8 @@
 // Copyright © 2026 kapper.net - KAPPER NETWORK-COMMUNICATIONS GmbH
 // SPDX-License-Identifier: EUPL-1.2
 
-import { mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { mkdir, open, readFile, rename, unlink } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { clampThinkingLevel } from "@earendil-works/pi-ai";
 import { CONFIG_DIR_NAME, type ExtensionAPI, type ExtensionContext } from "@earendil-works/pi-coding-agent";
@@ -60,9 +61,22 @@ export async function loadPreference(path: string): Promise<ProjectPreference |
 
 export async function savePreference(path: string, preference: ProjectPreference): Promise<void> {
   await mkdir(dirname(path), { recursive: true });
-  const temporaryPath = `${path}.tmp-${process.pid}`;
-  await writeFile(temporaryPath, `${JSON.stringify(preference, null, 2)}\n`, "utf8");
-  await rename(temporaryPath, path);
+  // Keep the temporary file in the destination directory so rename is atomic,
+  // while using an unpredictable, exclusively-created path to avoid clobbering
+  // or following files supplied by another local process.
+  const temporaryPath = `${path}.tmp-${randomUUID()}`;
+  let temporaryFile: Awaited<ReturnType<typeof open>> | undefined;
+  try {
+    temporaryFile = await open(temporaryPath, "wx", 0o600);
+    await temporaryFile.writeFile(`${JSON.stringify(preference, null, 2)}\n`, "utf8");
+    await temporaryFile.sync();
+    await temporaryFile.close();
+    temporaryFile = undefined;
+    await rename(temporaryPath, path);
+  } finally {
+    await temporaryFile?.close().catch(() => {});
+    await unlink(temporaryPath).catch(() => {});
+  }
 }
 
 export default function setModelExtension(pi: ExtensionAPI) {