[stack 3/8] fix(coding-agent): make persisted state crash-safe - #1160
[stack 3/8] fix(coding-agent): make persisted state crash-safe#1160sethkarten wants to merge 7 commits into
Conversation
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 1c74fdd. Configure here.
| data: string | NodeJS.ArrayBufferView, | ||
| options: AtomicReplaceOptions = {}, | ||
| ): void { | ||
| replaceFileAtomicallySync(path, (fd) => writeFileSync(fd, data), options); |
There was a problem hiding this comment.
Atomic writes follow planted symlinks
High Severity
writeFileAtomicallySync always re-resolves through resolveFileTargetSync, which follows a final-component symlink via realpathSync. Auth and settings call resolveManagedFilePathSync first to reject symlinks, then write with this helper, so a symlink planted after that check is followed and the symlink target is overwritten. The previous writePrivateFileAtomic renamed onto the lexical path and replaced the symlink itself.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit 1c74fdd. Configure here.
| function ensurePrivateDirectory(path: string): void { | ||
| if (!existsSync(path)) mkdirSync(path, { recursive: true, mode: 0o700 }); | ||
| chmodSync(path, 0o700); | ||
| } |
There was a problem hiding this comment.
Weaker duplicate directory helper
Medium Severity
FileSettingsStorage defines a local ensurePrivateDirectory that only mkdir/chmods, while private-files.ts already exports a stronger helper that rejects symlinks and non-directories. Auth and session code use the shared helper; settings reimplements a weaker copy, so symlink/non-directory parents are not refused consistently.
Reviewed by Cursor Bugbot for commit 1c74fdd. Configure here.
1 participant
Stack 3/8 — fix(coding-agent): make persisted state crash-safe
Base:
stack/external-02-securityReview order: merge only after the preceding stack layer is accepted. This PR is not intended to merge independently out of order.
Stack navigation
Summary
Validation
npm run check; persistence/session/config focused suites; final crash-lock duration suite pending remediation recheck.Provenance
upstream/mainusing issue reports and PR descriptions/comments only.Linked-item disposition
Fixed on merge
Independently superseded pull requests
Partial/distinct overlap — remains open
Reviewer notes
main, to avoid cumulative duplicate diffs.