Harden cache validation and staging OSError handling

Author: Copilot

src/specify_cli/__init__.py

@@ -6104,8 +6104,12 @@ def _safe_fetch(url: str) -> bytes:
 
     # Create steps_base_dir now so the staging temp dir is on the same filesystem,
     # enabling a truly atomic os.rename() below.
-    steps_base_dir.mkdir(parents=True, exist_ok=True)
-    tmp_path = Path(tempfile.mkdtemp(prefix="speckit_step_tmp_", dir=steps_base_dir))
+    try:
+        steps_base_dir.mkdir(parents=True, exist_ok=True)
+        tmp_path = Path(tempfile.mkdtemp(prefix="speckit_step_tmp_", dir=steps_base_dir))
+    except OSError as exc:
+        console.print(f"[red]Error:[/red] Failed to create staging directory: {exc}")
+        raise typer.Exit(1)
     try:
         try:
             step_yml_content = _safe_fetch(step_yml_url)
@@ -6209,7 +6213,11 @@ def _safe_fetch(url: str) -> bytes:
         # Both paths are under steps_base_dir (same filesystem), so os.rename()
         # is atomic on POSIX and won't leave a partially-written directory at
         # step_dir on failure.
-        os.rename(tmp_path, step_dir)
+        try:
+            os.rename(tmp_path, step_dir)
+        except OSError as exc:
+            console.print(f"[red]Error:[/red] Failed to install step '{step_id}': {exc}")
+            raise typer.Exit(1)
     finally:
         # Clean up if the rename hasn't moved tmp_path yet (i.e. on any failure).
         shutil.rmtree(tmp_path, ignore_errors=True)

src/specify_cli/workflows/catalog.py

@@ -924,7 +924,9 @@ def _fetch_single_catalog(
         if not force_refresh and self._is_url_cache_valid(entry.url):
             try:
                 with open(cache_file, encoding="utf-8") as f:
-                    return json.load(f)
+                    cached = json.load(f)
+                if isinstance(cached, dict):
+                    return cached
             except (json.JSONDecodeError, OSError):
                 pass
 
@@ -955,7 +957,9 @@ def _validate_url(url: str) -> None:
             if cache_file.exists():
                 try:
                     with open(cache_file, encoding="utf-8") as f:
-                        return json.load(f)
+                        cached = json.load(f)
+                    if isinstance(cached, dict):
+                        return cached
                 except (json.JSONDecodeError, ValueError, OSError):
                     pass
             raise StepCatalogError(