skillrepo 2.0.0 → 3.1.0

package/src/lib/fs-utils.mjs

@@ -3,7 +3,16 @@
  * Creates directories as needed, handles errors cleanly.
  */
 
-import { readFileSync, writeFileSync, existsSync, mkdirSync, statSync, chmodSync } from "node:fs";
+import {
+  readFileSync,
+  writeFileSync,
+  existsSync,
+  mkdirSync,
+  statSync,
+  chmodSync,
+  renameSync,
+  unlinkSync,
+} from "node:fs";
 import { dirname } from "node:path";
 
 /**
@@ -50,3 +59,76 @@ export function writeExecutable(filePath, content) {
 export function pathExists(p) {
   return existsSync(p);
 }
+
+/**
+ * Atomic write via temp-file + rename. Matches the pattern in
+ * `config.mjs`: write to `<path>.tmp`, then `renameSync` into place
+ * so the destination is never observed in a half-written state, and
+ * unlink the temp file on rename failure so a partial credential
+ * value is never left behind on disk.
+ *
+ * Use this (not `writeFileSafe`) for any module that modifies a user
+ * config file containing credentials or shared state. The uninstall
+ * removers (#885) touch `.env.local`, `.mcp.json`, and
+ * `settings.local.json` — all three benefit from atomic writes, the
+ * first two because of the credential-leak risk, the third because
+ * Claude Code parses it on startup and a half-written JSON would
+ * break the user's session.
+ *
+ * Parent-directory semantics match `writeFileSafe`: created
+ * recursively if missing. Directory-as-file collision is rejected
+ * before the temp-file is written.
+ *
+ * @param {string} filePath - Absolute path to the final destination.
+ * @param {string} content - UTF-8 content to persist.
+ * @param {object} [options]
+ * @param {number} [options.mode] - chmod applied to the temp file
+ *        BEFORE rename so the destination never exists with looser
+ *        permissions than intended. Skipped on Windows.
+ */
+export function writeFileAtomic(filePath, content, { mode } = {}) {
+  const dir = dirname(filePath);
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true });
+  }
+  if (existsSync(filePath) && statSync(filePath).isDirectory()) {
+    throw new Error(`${filePath} is a directory, expected a file`);
+  }
+
+  const tmpPath = `${filePath}.tmp`;
+  try {
+    writeFileSync(tmpPath, content, "utf-8");
+  } catch (err) {
+    // Re-throw with a clearer message but preserve the cause for
+    // --verbose. A temp-file write failure is almost always a
+    // permissions or disk-full issue; the original error surfaces it.
+    throw new Error(`Cannot write ${tmpPath}: ${err.message}`, { cause: err });
+  }
+
+  if (mode !== undefined && process.platform !== "win32") {
+    try {
+      chmodSync(tmpPath, mode);
+    } catch {
+      // Non-fatal — same rationale as config.mjs: chmod failure
+      // doesn't corrupt the file, the destination just has looser
+      // permissions than intended. Callers that care can stat the
+      // file after the write.
+    }
+  }
+
+  try {
+    renameSync(tmpPath, filePath);
+  } catch (err) {
+    // Clean up the stale temp file so a partial credential value
+    // isn't left behind. Best-effort — if the unlink also fails,
+    // the original rename error is still what we surface.
+    try {
+      unlinkSync(tmpPath);
+    } catch {
+      /* best-effort */
+    }
+    throw new Error(`Cannot install ${filePath}: ${err.message}`, {
+      cause: err,
+    });
+  }
+}