Closes #116. Core (profiles.core.config.io.yaml_io): - write_text_atomic(): temp file in the target directory, fsync, then os.replace — a crash or power loss mid-save can no longer truncate the user's only .profiles file - content_hash(): SHA-256 hex of a text, the version marker for the staleness guard Server (/api/config): - GET /content now also returns content_hash (hash of the served text) - POST /save accepts an optional baseline_hash: a mismatch with the on-disk file — an external edit landing between the editor's load and its Save — answers 409 instead of silently clobbering; overwrite_changes=true is the "overwrite anyway" escape hatch; the field is optional, so older callers keep the no-check behavior - POST /save and /save-as write through write_text_atomic; both responses carry content_hash (the next save's baseline) Web (ConfigEditorModal): - every load/revert records the baseline hash; every save sends it - a 409 parks a "File changed on disk" ConfirmDialog offering "Reload disk version" (re-fetch, adopt external edits) or "Overwrite anyway" (retry with overwrite_changes) - a successful save refreshes the baseline from the response's content_hash Tests: yaml_io atomic-write/hash unit tests, 409-guard route tests (stale, matching, overwrite-anyway, no-baseline legacy, vanished file), client contract tests, and three editor flow tests (overwrite path, reload path, baseline refresh). Suite 1505 pass, web 246 pass, ruff/pylint (9.89)/pyright clean.

Commits

Commits on Nov 4, 2026

feat(editor): protect config saves — atomic write + staleness guard