This is a comment left during a code review.
Path: src/shared/fs-atomic-fix.ts
Line: 1-19

Comment:
**Fix is orphaned — crash still occurs**

`writeTextFileAtomicSync` is defined here but never imported or called anywhere in the codebase. The function that actually triggers the crash is `writeTextFileAtomic` in `src/secrets/shared.ts` (line 62), which still contains the unprotected `fs.chmodSync` call:

```typescript
// src/secrets/shared.ts – still unpatched
fs.chmodSync(tempPath, mode);
```

All callers (e.g. `src/secrets/apply.ts` line 829, `restoreFileSnapshot` at line 737) go through that existing function. Until `src/secrets/shared.ts` is updated, issue #53947 will continue to reproduce on every write.

The fix should be applied directly to `writeTextFileAtomic` in `src/secrets/shared.ts`:

```typescript
export function writeTextFileAtomic(pathname: string, value: string, mode = 0o600): void {
  ensureDirForFile(pathname);
  const tempPath = `${pathname}.tmp-${process.pid}-${Date.now()}`;
  fs.writeFileSync(tempPath, value, "utf8");
  try {
    fs.chmodSync(tempPath, mode);
  } catch {
    // EPERM expected on NTFS/CIFS mounts (Windows Docker Desktop)
  }
  fs.renameSync(tempPath, pathname);
}
```

`writeJsonFileSecure` (line 48 of `src/secrets/shared.ts`) has the same unguarded `chmodSync` and should also be patched.

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: src/shared/fs-atomic-fix.ts
Line: 8-9

Comment:
**Missing `ensureDirForFile` before write**

The existing `writeTextFileAtomic` in `src/secrets/shared.ts` calls `ensureDirForFile(pathname)` before creating the temp file (line 59), ensuring the parent directory exists. This new implementation skips that step and will throw `ENOENT` if the destination directory doesn't already exist — a regression compared to the function it intends to replace.

```suggestion
    const tempPath = `${pathname}.tmp-${process.pid}-${Date.now()}`;
    fs.mkdirSync(require("path").dirname(pathname), { recursive: true, mode: 0o700 });
    fs.writeFileSync(tempPath, value, "utf8");
```

Or import and call the shared `ensureDirForFile` helper if this file is kept.

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: src/shared/fs-atomic-fix.ts
Line: 1

Comment:
**Node built-in import convention**

The rest of the codebase uses the `node:` protocol prefix for built-in modules (e.g. `import fs from "node:fs"` in `src/secrets/shared.ts`, `src/secrets/apply.ts`, etc.). The bare `"fs"` import here is inconsistent.

```suggestion
import fs from "node:fs";
```

How can I resolve this? If you propose a fix, please make it concise.