Skip to content

[robustness] Atomic config write replaces symlinked config files and races on fixed .tmp/.backup names #534

Description

@dsarno

Severity: Low · From pre-release robustness review (2026-06-09, be40e1c, v2.6.0)

Location: plugin/addons/godot_ai/clients/_atomic_write.gd:23,33,41,75

Risk: Users managing ~/.cursor/mcp.json via stow/chezmoi symlinks get the symlink clobbered by rename_absolute — the dotfile repo silently stops tracking the live file. And two editors clicking Configure near-simultaneously share the same path+".tmp" and can interleave (one renames/removes the other's partial tmp) — the same multi-editor scenario the session registry supports.

Fix: Resolve symlink targets before the temp+rename (or overwrite in place for symlinks); suffix the tmp name with PID or a random token.

Metadata

Metadata

Assignees

No one assigned

    Labels

    area: telemetryTelemetry & config writersrobustnessRobustness/hardening finding from pre-release reviewseverity: lowLow severity

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions