fix(permissions): write approval backups atomically and exclusively

A direct wx write of .bak can crash mid-write and leave a torn
rollback copy. The next start treats that EEXIST as success and
purges live anyway. Write the full backup to a sibling tmp, then
link it onto .bak so the name appears complete or not at all, and
a pre-existing original still wins.

Author: TheGreatAxios

src/permission/approval-store-migration.test.ts

@@ -1,7 +1,14 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import {
+  chmod,
+  mkdir,
+  mkdtemp,
+  readFile,
+  rm,
+  writeFile,
+} from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { generateSessionId, sessionDir } from "../session/index.js";
 import { loadSeededApprovals } from "../session/runtime-assembly.js";
 import { normalizeSeededApprovals } from "./authz-grants.js";
@@ -267,4 +274,48 @@ describe("migratePersistedApprovalStores", () => {
     });
     expect(await readJson(projectStorePath())).toEqual({ approvals: [] });
   });
+
+  test("EACCES writing the backup leaves live bytes unchanged", async () => {
+    const path = sessionStorePath();
+    const original = {
+      approvals: [
+        { tool: "update_plan", pattern: "plan *" },
+        { tool: "run_shell", pattern: "npm *" },
+      ],
+    };
+    await writeFile(path, JSON.stringify(original));
+    const liveBytes = await readFile(path, "utf-8");
+    const dir = dirname(path);
+    await chmod(dir, 0o555);
+    try {
+      const result = await migratePersistedApprovalStores(cwd, sessionId, home);
+      expect(result.purged).toBe(0);
+      expect(result.backups).toEqual([]);
+      expect(await readFile(path, "utf-8")).toBe(liveBytes);
+    } finally {
+      await chmod(dir, 0o755);
+    }
+  });
+
+  test("existing torn .bak plus live update_plan still purges live", async () => {
+    const path = sessionStorePath();
+    const original = {
+      approvals: [
+        { tool: "update_plan", pattern: "plan *" },
+        { tool: "run_shell", pattern: "npm *" },
+      ],
+    };
+    await writeFile(path, JSON.stringify(original));
+    const torn = '{"approvals":[{"tool":"update_plan"';
+    await writeFile(backupPath(path), torn);
+
+    const result = await migratePersistedApprovalStores(cwd, sessionId, home);
+
+    expect(result.purged).toBe(1);
+    expect(result.backups).toEqual([backupPath(path)]);
+    expect(await readFile(backupPath(path), "utf-8")).toBe(torn);
+    expect(await readJson(path)).toEqual({
+      approvals: [{ tool: "run_shell", pattern: "npm *" }],
+    });
+  });
 });

src/permission/approval-store-migration.ts

@@ -1,4 +1,4 @@
-import { writeFile } from "node:fs/promises";
+import { link, unlink, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
@@ -62,6 +62,25 @@ function isFileExistsError(err: unknown): boolean {
   );
 }
 
+// Exclusive atomic backup: fully write a sibling tmp, then link it onto
+// `.bak` so the rollback copy never appears torn. rename would replace a
+// pre-existing bak and lose first-original-wins; a direct wx write of `.bak`
+// can crash mid-write and leave a truncated file that a later start treats as
+// EEXIST success. link is exclusive (EEXIST if the name is taken) and the
+// destination inode is complete at the moment it appears.
+async function writeBackupExclusive(
+  backupPath: string,
+  body: string,
+): Promise<void> {
+  const tmp = `${backupPath}.${process.pid}.tmp`;
+  try {
+    await writeFile(tmp, body);
+    await link(tmp, backupPath);
+  } finally {
+    await unlink(tmp).catch(() => undefined);
+  }
+}
+
 // Purge update_plan keys from one approvals file (session, project, or
 // global store shape: an `approvals` array plus, for the global file, a
 // `providerModels` map of arrays). Backup-then-rewrite: the pre-migration
@@ -74,7 +93,8 @@ function isFileExistsError(err: unknown): boolean {
 // propagate. The rewrite goes through chainObjectWrite, so a concurrent grant
 // mint to the same file serializes with the migration instead of losing an
 // update, and the tmp+rename lands atomically so a reader never sees a torn
-// file.
+// file. The backup uses the same tmp-then-place atomicity, exclusive so a
+// pre-existing `.bak` wins.
 export async function migrateApprovalStoreFile(
   path: string,
 ): Promise<ApprovalStoreMigrationFileResult> {
@@ -113,9 +133,10 @@ export async function migrateApprovalStoreFile(
       }
       if (changed === 0) return undefined;
       try {
-        await writeFile(backupPath, JSON.stringify(current, null, 2), {
-          flag: "wx",
-        });
+        await writeBackupExclusive(
+          backupPath,
+          JSON.stringify(current, null, 2),
+        );
       } catch (err) {
         if (!isFileExistsError(err)) {
           log.warn("Skipping approval-store migration for {path}: {error}", {