fix(init): publish preserved rollback snapshot with no-replace copy

Date.now-based renameSync could silently overwrite an existing rollback
snapshot on POSIX when the destination already existed (frozen clock,
clock rollback, pre-created file). Use copyFileSync with COPYFILE_EXCL
plus a sequence-suffix retry so a destination collision never destroys
another snapshot, then unlink the source only after publication.

Author: lidge-jun

src/cli/init.ts

@@ -1,5 +1,5 @@
 import * as readline from "node:readline";
-import { existsSync, readFileSync, renameSync, unlinkSync } from "node:fs";
+import { constants as fsConstants, copyFileSync, existsSync, readFileSync, unlinkSync } from "node:fs";
 import { injectCodexConfig } from "../codex/inject";
 import { classifyOpenAiTierBackup, getConfigPath, getDefaultConfig, isValidProviderName, saveConfig } from "../config";
 import { enrichProviderFromCatalog } from "../oauth/key-providers";
@@ -63,9 +63,21 @@ export function cleanupOpenAiTierBackupAfterInit(configPath = getConfigPath()):
       unlinkSync(backup);
       return;
     }
-    const preserved = `${configPath}.pre-openai-tiers-v1-rollback.${Date.now()}.bak`;
-    renameSync(backup, preserved);
-    console.warn(`⚠️  Kept your pre-migration config rollback snapshot at ${preserved}`);
+    // Publish the preserved snapshot with a no-replace copy (COPYFILE_EXCL) so a
+    // destination collision (frozen/rolled-back clock, pre-created file) can never
+    // silently overwrite another rollback snapshot; retry with a sequence suffix.
+    for (let attempt = 0; attempt < 16; attempt++) {
+      const preserved = `${configPath}.pre-openai-tiers-v1-rollback.${Date.now()}${attempt ? `-${attempt}` : ""}.bak`;
+      try {
+        copyFileSync(backup, preserved, fsConstants.COPYFILE_EXCL);
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code === "EEXIST") continue;
+        throw error;
+      }
+      unlinkSync(backup);
+      console.warn(`⚠️  Kept your pre-migration config rollback snapshot at ${preserved}`);
+      return;
+    }
   } catch { /* cleanup is best-effort; never block init on backup housekeeping */ }
 }
 

tests/init-backup-cleanup.test.ts

@@ -55,6 +55,32 @@ describe("cleanupOpenAiTierBackupAfterInit", () => {
     expect(readFileSync(join(dir, preserved[0]!), "utf8")).toBe(v1);
   });
 
+  test("does not overwrite an occupied rollback destination (no-replace publication)", () => {
+    const dir = makeDir();
+    const configPath = join(dir, "config.json");
+    const backup = `${configPath}.pre-openai-tiers-v2.bak`;
+    const v1 = JSON.stringify({ openaiProviderTierVersion: 1, port: 10100, defaultProvider: "openai", providers: {} });
+    writeFileSync(backup, v1);
+    // Pre-occupy the first-choice destination for the current clock tick(s).
+    const now = Date.now();
+    const existing = `${configPath}.pre-openai-tiers-v1-rollback.${now}.bak`;
+    writeFileSync(existing, "existing rollback");
+    const realNow = Date.now;
+    Date.now = () => now; // freeze the clock so the collision is deterministic
+    try {
+      cleanupOpenAiTierBackupAfterInit(configPath);
+    } finally {
+      Date.now = realNow;
+    }
+    // The pre-existing snapshot must be untouched, and the v1 backup preserved elsewhere.
+    expect(readFileSync(existing, "utf8")).toBe("existing rollback");
+    expect(existsSync(backup)).toBe(false);
+    const preserved = readdirSync(dir)
+      .filter(name => name.includes("pre-openai-tiers-v1-rollback") && join(dir, name) !== existing);
+    expect(preserved).toHaveLength(1);
+    expect(readFileSync(join(dir, preserved[0]!), "utf8")).toBe(v1);
+  });
+
   test("classifyOpenAiTierBackup shares the migration policy", () => {
     const enc = (value: string) => new TextEncoder().encode(value);
     expect(classifyOpenAiTierBackup(enc(JSON.stringify({ openaiProviderTierVersion: 2 })))).toBe("stale");