fix: make credential file writes atomic and fail closed on corruption

[bukinoshita]

Summary by cubic

Prevents silent loss of saved auth profiles by making credential writes atomic and locked, and by failing closed on corrupted JSON.

• Bug Fixes
  • Atomic writes: temp file + fsync + rename to avoid partial/truncated credentials.json.
  • Advisory lock around read/modify/write to prevent concurrent races.
  • readCredentials() throws CorruptedCredentialsError on invalid JSON; file is preserved; mutators stop instead of rebuilding empty state.
  • Mutators (storeApiKey, removeApiKey, setActiveProfile, renameProfile, storeApiKeyAsync) use immutable updates under the lock; removeApiKey no longer deletes on parse failure.
  • Logout gracefully handles corrupted credentials and still proceeds to the removal path.

^{Written for commit 219f90b. Summary will update on new commits.}

[bukinoshita]

@cubic-dev-ai can you review?

[cubic-dev-ai]

@cubic-dev-ai can you review?

@bukinoshita I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

3 issues found across 7 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/lib/file-lock.ts">

<violation number="1" location="src/lib/file-lock.ts:61">
P2: `sleepSync` burns 100% CPU while spinning. Use `Atomics.wait` for a zero-CPU synchronous sleep — it's available in all supported Node versions (≥20).</violation>
</file>

<file name="src/lib/config.ts">

<violation number="1" location="src/lib/config.ts:394">
P1: The auto-migration write inside `resolveApiKeyAsync` still mutates `creds` in-place and calls `writeCredentials` without `withFileLock`, leaving the same lost-update race this PR eliminates everywhere else. Wrap the write in `withFileLock` and use immutable updates to match the other mutators.</violation>
</file>

<file name="src/commands/auth/logout.ts">

<violation number="1" location="src/commands/auth/logout.ts:52">
P2: This change still allows an uncaught credentials-read throw via `resolveProfileName()`, so logout can crash on corrupted credentials instead of reaching the `remove_failed` handling path.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}