Plan Z1 / spec §20.3.
apps/daemon/src/plugins/atoms/patch-edit.ts gains an
`atomicWriteFile(target, body)` helper:
1. Write body to `<target>.<random>.tmp` (sibling of target).
2. fs.rename(2) the tmp into place — atomic on POSIX when
source + target share a filesystem (which they always do
here because the tmp is sibling).
3. On failure, best-effort unlink the orphan tmp.
Every fs.writeFile call inside patch-edit now routes through it:
- file creation (--- /dev/null target)
- plain in-place edits
- plan/steps.json status updates
- plan/receipts/step-<id>.json receipt writes
Effect: a daemon crash mid-write (SIGKILL, ENOSPC, etc.) can no
longer leave the source file truncated — the rename either
happens fully or not at all. The tmp file is the only collateral,
and the orphan-cleanup path keeps even that contained.
The test harness asserts both halves of the contract:
- happy path leaves NO .tmp siblings on disk
- context-mismatch rejection leaves the original byte-equal
(atomicity covers the failure path too)
- plan/ + plan/receipts/ never accumulate .tmp leftovers
Daemon tests: 1699 \u2192 1702 (+3 cases on
plugins-patch-edit-atomic: clean rename leaves no .tmp, rejected
patch preserves byte-equal source, plan/receipt writes never
leak .tmp siblings).
Co-authored-by: Tom Huang <1043269994@qq.com>
Cursor Agent