102 lines
3.2 KiB
JavaScript
102 lines
3.2 KiB
JavaScript
/**
|
|
* @file config-write.js
|
|
* @description Shared safe-write primitives for config writers (cc-mutate.js
|
|
* for Claude Code, and any Codex equivalent): path containment, timestamped
|
|
* backup-before-mutate, and atomic file write. Extracted out of cc-mutate.js
|
|
* so both writers share one copy of this security-sensitive code instead of
|
|
* diverging copies.
|
|
*
|
|
* Hard constraints (do not relax without a follow-up review):
|
|
* - Backups happen BEFORE the mutation and land outside the tree being
|
|
* backed up (caller passes `backupRoot`).
|
|
* - Writes are atomic via temp file + fs.renameSync. Tmp is removed on
|
|
* any failure path.
|
|
* - `assertUnder` is the single containment check callers must run on any
|
|
* resolved path before touching disk.
|
|
* @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
|
|
*/
|
|
|
|
const fs = require("node:fs");
|
|
const path = require("node:path");
|
|
const { isUnder } = require("./cc-discovery");
|
|
|
|
function timestamp() {
|
|
return new Date().toISOString().replace(/[:]/g, "-");
|
|
}
|
|
|
|
function copyDirSync(src, dst) {
|
|
fs.mkdirSync(dst, { recursive: true });
|
|
for (const ent of fs.readdirSync(src, { withFileTypes: true })) {
|
|
const s = path.join(src, ent.name);
|
|
const d = path.join(dst, ent.name);
|
|
if (ent.isDirectory()) copyDirSync(s, d);
|
|
else if (ent.isFile()) fs.copyFileSync(s, d);
|
|
// symlinks/sockets/etc skipped intentionally — these surfaces are
|
|
// text-file-only by spec
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Always-on backup. Copies `source` (file or directory tree) into
|
|
* `backupRoot` as `<name>.<ts>.bak`. Returns the backup path, or null if
|
|
* `source` does not exist (e.g. brand-new file/skill).
|
|
*/
|
|
function createBackup({ source, backupRoot, type, name }) {
|
|
if (!fs.existsSync(source)) return null;
|
|
fs.mkdirSync(backupRoot, { recursive: true });
|
|
const stamp = timestamp();
|
|
const dst = path.join(backupRoot, `${name}.${stamp}.bak`);
|
|
if (fs.statSync(source).isDirectory()) {
|
|
copyDirSync(source, dst);
|
|
} else {
|
|
fs.copyFileSync(source, dst);
|
|
}
|
|
return dst;
|
|
}
|
|
|
|
/**
|
|
* Atomic write: tmp file → fsync (best-effort) → rename. Tmp is unlinked
|
|
* on any failure path. Caller is responsible for ensuring parent dir exists.
|
|
*/
|
|
function atomicWriteFile(filePath, content) {
|
|
const dir = path.dirname(filePath);
|
|
fs.mkdirSync(dir, { recursive: true });
|
|
const tmp = path.join(dir, `.${path.basename(filePath)}.${process.pid}.${Date.now()}.tmp`);
|
|
let fd;
|
|
try {
|
|
fd = fs.openSync(tmp, "wx");
|
|
fs.writeSync(fd, content);
|
|
try {
|
|
fs.fsyncSync(fd);
|
|
} catch {
|
|
// fsync may fail on some filesystems / tmpfs — non-fatal
|
|
}
|
|
fs.closeSync(fd);
|
|
fd = null;
|
|
fs.renameSync(tmp, filePath);
|
|
} catch (err) {
|
|
try {
|
|
if (fd != null) fs.closeSync(fd);
|
|
} catch {
|
|
/* ignore */
|
|
}
|
|
try {
|
|
if (fs.existsSync(tmp)) fs.unlinkSync(tmp);
|
|
} catch {
|
|
/* ignore */
|
|
}
|
|
throw err;
|
|
}
|
|
}
|
|
|
|
/** Throw EOUTOFROOT unless `target` resolves to `root` or a descendant. */
|
|
function assertUnder(root, target) {
|
|
if (!isUnder(root, target)) {
|
|
const err = new Error("resolved path is outside containment root");
|
|
err.code = "EOUTOFROOT";
|
|
throw err;
|
|
}
|
|
}
|
|
|
|
module.exports = { timestamp, createBackup, atomicWriteFile, assertUnder };
|