Repository navigation
Protect safeWriteText staging entry from replacement through commit #2391
Description
Summary
Protect the caller-supplied staging file in src/services/file-safety/safeWriteText.ts against replacement between validation, opening, and publication.
At PR #2385 head b6a8e829b49a8e17d225c6849e9be659ab3a4324, the writer checks that tempPath is a regular file beside the target and does not alias the target. Another process that can modify the staging directory can replace that entry after validation. An early swap can make the writer open or change the mode of a different file. A later swap can make the rename or no-replace link publish a substituted entry instead of the staged content.
Required work
Choose and implement a mechanism that protects the validated staging object through opening and publication. Decide how the mechanism affects the caller-supplied tempPath contract and its cleanup behavior. A handle plus a separate identity check before a pathname-based commit does not, by itself, close the interval between that check and the commit. Consider the supported platforms and both ordinary rename and failIfExist publication.
Acceptance criteria
- A staging entry replaced after validation cannot cause the writer to modify an unintended file or publish a substituted entry.
- Cleanup does not remove an entry that the write does not own.
- Add focused regression tests that exercise replacement before opening and between staging and publication, including the no-replace path.
- Document any change to the
tempPathcontract and validate the chosen mechanism on supported platforms.
References
- Source PR: feat(file-safety): land safeWriteText as its own unit (u1 of the #2357 split plan, content unchanged) #2385
- Review thread: feat(file-safety): land safeWriteText as its own unit (u1 of the #2357 split plan, content unchanged) #2385 (comment)
- Related staging-name contract: safeWriteText's staging-name guard and jsonFileRecovery's leftover prefixes are mutually exclusive #2350
- Requested by @easonLiangWorldedtech
Activity
file-safety: close the four pre-commit and post-commit gaps CodeRabbi…
easonLiangWorldedtech commentedon Nov 10, 2026
Reporting a failing row that belongs to this chain rather than opening a competing issue.
Row: src/services/file-safety/tests/safeWriteText.integration.spec.ts > "publishes the new bytes and leaves no staging or backup residue" fails with DaclRestoreError, thrown from src/services/file-safety/safeWriteText.ts:587, reached through the step-5 restore call _restoreDaclWindows at 578.
Where it reproduces, all on node v22.23.4 with vitest run from the package directory:
Search done before filing anything here, all scoped to open issues in this repository: DaclRestoreError (10 hits, among them #2392 Protect Windows DACLs throughout safeWriteText publication, #2402 safeWriteText reports post-commit failures only through the ..., #2385, #2357), DACL (28 hits, same leaders), direct-entry (127 hits, none about this primitive).
Posting the row on this issue because it is the staging-entry protection home named by the lane lead, and naming #2392 and #2402 so the DACL restore failure itself is not re-filed a third time.