[ymichael]

Human comments

What was wrong

host.write_file without expectedSha256 overwrote its target in place, so a crash or full disk partway through left a truncated file. host.read_file_relative loaded whole files with no size limit and sent them as one base64 WebSocket message. Both bugs came from duplicated paths. There were two whole-file reads: read_file_relative was built for the status-folder server, removed in June, and its only remaining caller was the provider-skill read. There were also three hand-written copies of the temp-file, hash-check, rename save, so a fix in one never reached the others.

What changed

• One atomic save: new dependency-free package @bb/file-transfer. verified-file-transfer.ts (from Stream prompt attachments from server to daemon without buffering #6332/Transfer skill trees by manifest, fetching only missing files #6330) moved into it unchanged, apart from the durable and mode arguments below. A new replaceFile does the whole save:
  1. check the expected hash;
  2. write and fsync a fixed-length .bb-write-<uuid> temp file next to the target;
  3. put it in place:
     • no hash: rename over the target;
     • expectedSha256: null: no-clobber link;
     • a hash: re-check, then rename.
  • Who uses it: writeHostFile keeps only root confinement, parent creation and error mapping. The server-owned skill save in skill-listing.ts calls replaceFile directly instead of its own copy.
  • Modes: an existing file keeps its mode exactly. A requested mode on a new file goes through open(), so the umask applies, as on main.
  • Read-only folders: an unconditional write falls back to overwriting in place, as on main. A hash-checked save fails with EACCES, as on main.
  • fsync: writeVerifiedFile takes durable (user saves fsync; attachments and skill trees don't) and an explicit create-or-exact mode.
• One whole-file read: removed host.read_file_relative. The skill read now uses host.read_file, which has the 25 MB (10 MB image) cap.
  • Symlinked skill folders: host.read_file gains a required followRootSymlink boolean, matching host.list_files, so linked skill folders still resolve (Fix skill details for symlinked skill directories #5556). Skill reads pass true; every other caller passes false. The schema rejects true with a git ref or without a rootPath.
  • Server-side path checks: the server rejects absolute, .. and dotfile skill paths before calling the host, using the same check server-owned skills already used.
  • Errors: an oversized skill file now returns 413 instead of 502.
• Wire change: HOST_DAEMON_PROTOCOL_VERSION goes from 255 to 256, for the removed command and the new required field. host.write_file's fields and results are unchanged.
• Docs: updated the symlinked-skill paragraph in docs/debugging-and-qa.md.
• Behaviour note: saves replace the file, so hard links, xattrs and ACLs on an overwritten file aren't carried over. Hash-checked saves already worked this way.

How you verified

• New tests:
  • @bb/file-transfer:
    • an interrupted write leaves the original intact;
    • read-only folder: an unconditional write lands in place, a hash-checked save is refused;
    • a requested mode respects the umask;
    • a 240-character filename saves.
  • daemon: an oversized read under a followed root is rejected.
  • server:
    • oversized skill file → 413;
    • absolute, .. and dotfile skill paths are rejected without calling the host;
    • server-owned skill save writes on a fresh revision and returns 409 on a stale one.
  • Each failed before its fix.
• Commands:
  • pnpm exec turbo run typecheck lint --filter='...[origin/main]': 133/133 tasks pass.
  • pnpm exec turbo run test for @bb/file-transfer (7), @bb/host-daemon-contract (76), @bb/host-daemon (833, 12 skipped) and @bb/server (3655 of 3656). The one server failure is a timeout in builtin-plugins.test.ts, which nothing on this branch touches. A different test in that file timed out on each full run, both under heavy machine load, and that file's 28 tests pass when run alone.
• Manual: a pnpm start:worktree instance with a fixture project, checked by a script of 24 CLI/API checks, all passing:
  • symlinked skill reads, the 27 MB → 413 case, rejected paths;
  • daemon- and server-saved skills: fresh save lands, stale save returns 409, no temp files left behind;
  • bb file write: unconditional, stale hash, read-only folder;
  • the umask and long-filename cases.

AGENT GENERATED

🤖 Generated with Claude Code