Yichen Jiang
90c3118302
Review round three, credentials half. dsh-atomic-write grows the cross-process writer-lock primitive (withFileLock: wx sentinel, bounded backoff, stale takeover via onStaleBreak, deadline failure) plus a dirMode option, and settings-local migrates its private copy to it; both providers now create harness-home directories 0700. credentials-local reuses the reviewed settings-local shape: watcher reloads and line edits share one settled operation chain; every write re-reads the document under the lock and publishes unobserved external entries before editing, so an edit inside the debounce window (or another process's write) can never be overwritten; the watcher's ready signal queues one reconcile closing the startup gap. The line editor is now physical-line aware: continuation lines of a quoted multi-line value are never mistaken for assignments, untouched lines keep their exact bytes (CRLF included), an edited line keeps its own terminator, and appends use the document's dominant ending. A multi-line entry reports writable: false, matching what set() would do. The Credentials base class owns a contained notifyUpdated fan-out: providers publish only after the commit, every listener runs, sync throws and async rejections are logged without failing the committed write, and INVARIANT-coded failures rethrow after the fan-out.
dsh-atomic-write
English | 中文
Zero-dependency atomic file replacement shared by file-backed stores that must never leave partial, symlink-hijacked, or wider-than-intended content on disk — the user-settings document (dsh-settings-local) and the credentials store (dsh-credentials-local).
Surface
import { writeFileAtomic } from '@deepseek-ai/dsh-atomic-write'
declare const text: string
await writeFileAtomic('/home/u/.dsh/settings.yaml', text, { mode: 0o600 })
One export. The contract, in the order failures would exploit it:
- Exclusive-create temp (
wx, random suffix): the open refuses to follow a symlink planted at a guessable temp path. - The fresh inode carries
modethrough the rename: replacing a wider-permission file narrows it without a chmod race.modeis required so the permission decision stays visible at every call site (subject to the process umask, like every fresh inode). renamereplaces a symlinked target itself, never writing through to its referent.- Same-directory sibling keeps the rename on one filesystem, so the swap stays atomic.
- Parent directories are created; on any failure the temp is removed and the failure rethrown; readers observe either the old or the new complete content.
Model Experience
None, as this is a pure filesystem primitive; nothing here reaches a model request.
KV Cache effect
None; nothing here enters a request prefix.
Known Limitations and Deferred Work
- Atomic, not durable — no
fsyncof the file or its directory, so after a crash the rename may be observed unwound. The file-backed stores here re-read and republish on boot, keeping durability the caller's policy. - String content only — no
Bufferor stream form until a consumer needs one.