fix(selfhost): make env_put's .env write atomic (mv) while preserving the target file's mode

[xfodev]

What & why

env_put() (scripts/lib/selfhost-deploy-common.sh) creates a same-directory temp file via mktemp — its own comment justifies this as enabling an atomic swap — but then writes with cat "$tmp" >"$file"; rm -f "$tmp", a truncate-then-copy, not a rename. A crash/kill/power-loss mid-write (this runs during self-host deploys, e.g. env_put LOOPOVER_IMAGE "$IMAGE" at the end of deploy-selfhost-image.sh) can leave .env truncated/corrupted — exactly what the same-directory temp file was meant to prevent.

Change

Swap to an atomic mv "$tmp" "$file", mirroring the same-directory-temp + mv idiom already used in backup-metrics.sh / browserless-metrics.sh / export-ams-reporting-db.sh.

Caveat handled: mktemp creates $tmp at 0600, so a bare mv would silently narrow .env's permissions on every write. The fix captures the target's existing mode first (GNU stat -c '%a' with a BSD stat -f '%Lp' fallback — the same stat-portability idiom backup-metrics.sh uses) and chmods $tmp to match before the mv.

Adds env_put tests to test/unit/selfhost-deploy-common.test.ts (which had none): in-place key update, append-when-absent, mode preservation (set 0640, assert unchanged), and no-leftover-temp-file (proving a rename, not a copy).

scripts/**/.sh is outside Codecov's coverage.include, so codecov/patch doesn't gate it — the tests run in the backend vitest suite. Verified locally: 8 tests in the file pass (4 new), a 41-test selfhost regression sweep is green, bash -n clean, root tsc --noEmit clean, and git diff --check clean.

Closes #7766

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.37%. Comparing base (9d95c96) to head (074e29e).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7835   +/-   ##
=======================================
  Coverage   91.37%   91.37%           
=======================================
  Files         729      729           
  Lines       74671    74671           
  Branches    22791    22790    -1     
=======================================
  Hits        68229    68229           
  Misses       5396     5396           
  Partials     1046     1046           

Flag	Coverage Δ
shard-1	54.49% <ø> (ø)
shard-2	55.18% <ø> (ø)
shard-3	51.34% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

[loopover-orb]

Tip

✅ LoopOver review result - approve/merge recommended

_{Review updated: 2026-07-21 14:52:24 UTC}

2 files · 1 AI reviewer · no blockers · readiness 98/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This correctly identifies that env_put's same-directory temp file (created specifically to enable an atomic swap, per the existing comment) was undermined by a truncate-then-copy `cat`/`rm` pattern, and replaces it with `mv`. It also correctly handles the mode-preservation caveat: mktemp defaults to 0600, so the diff captures the target's existing mode via `stat -c '%a'` (with a BSD `stat -f '%Lp'` fallback) and chmods the temp file before the rename, avoiding a silent permission regression on `.env` files with a non-default mode. The added tests exercise the real code path directly (sourcing the lib and invoking env_put via bash -c) and assert on genuinely observable outcomes: file contents, mode bits, and absence of a leftover temp file — these are not fabricated scenarios.

Nits — 4 non-blocking

• scripts/lib/selfhost-deploy-common.sh: if `stat -c` fails for a reason other than not-being-GNU (e.g. file briefly missing) and the `stat -f` fallback also fails, `mode` will be empty and the subsequent `chmod "" "$tmp"` will error out — acceptable fail-closed behavior but worth a one-line comment noting it's intentional.
• test/unit/selfhost-deploy-common.test.ts: the mode-preservation test only checks 0640; consider also asserting the default `touch`-created mode case (e.g. when the file didn't previously exist) still ends up at a sane default rather than mktemp's 0600, though this is a minor coverage gap.
• Consider consolidating the stat-portability idiom (GNU `stat -c` / BSD `stat -f` fallback) into a shared helper if it recurs in a fourth script, per the PR's own note that it already exists in backup-metrics.sh.
• The test file could add a case where the target file did not previously exist (fresh `touch`) to confirm no unexpected mode issues arise from the `stat` call happening after `touch` but before content is written.

Decision drivers

• ✅ Code review — No blockers (1 reviewer)
• ✅ Gate result — Passing (No configured blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#7766
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 80 registered-repo PR(s), 46 merged, 0 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	xfodev; Gittensor profile; 80 PR(s), 0 issue(s).
Improvement	ℹ️ Insufficient signal	risk: clean · value: insufficient-signal

Linked issue satisfaction

Addressed
The diff replaces the truncate-then-copy with chmod-then-mv to perform an atomic rename while capturing and preserving the target file's original mode via stat, exactly as requested, and adds tests for in-place update, append, mode preservation, and absence of leftover temp files.

Review context

• Author: xfodev
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: JavaScript, TypeScript
• Official Gittensor activity: 80 PR(s), 0 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review