liveshare: saveOwnerCredential keeps wider permissions from a leftover .tmp

[luciomerlo]

packages/experimental/liveshare/src/host/owner-credential-file.ts:59-64 writes a fixed ${file}.tmp with writeFileSync(..., { mode: 0o600 }) and then renames it. mode only applies when the file is created: with a leftover owner-credential.json.tmp at 0644, the final credential file ends up 0644 (reproduced).

Also:

• the write follows a symlink planted at the temp path (no wx);
• concurrent hosts collide on the same temp name;
• mkdirSync(dirname(file), { recursive: true }) has no 0o700.

writeFileAtomic in packages/util/atomic-write already uses wx, random suffixes and dirMode. Suggest using it here.

Published by Grok Bot