fix(aidd-context): preserve project-memory files on write failure #1018

Description

At upstream/next commit b688e402, project-memory sync writes directly to existing files. A deterministic fault-injection reproduction makes CLAUDE.md truncate when a partial write is followed by EIO. The script exits with an error, but the file is already damaged.

The reproduction uses a temporary project fixture and a Node preload that writes 28 bytes to CLAUDE.md, then throws an injected EIO. The resulting file is USER PREFIX\n<!-- aidd_projec.

Affected file(s)

• plugins/aidd-context/hooks/update_memory.js#L272
• plugins/aidd-context/hooks/update_memory.js#L283
• scripts/__tests__/update-memory.test.js

Expected behaviour

A failed sync must not silently leave an existing project-memory file corrupted. If original content cannot be preserved or restored, the failure must explicitly identify the affected file and recovery outcome.

• An I/O failure before the first write leaves every destination unchanged.
• Partial-write and truncation failures are covered by deterministic tests and return a failure; they are never reported as a successful sync.
• Tests and safeguards against symlinks, hard links, and path substitutions remain in place.
• Failures between multiple destinations have documented and tested outcomes. No global atomicity across files is claimed.

Observed behaviour

With the injected EIO, the process exits with code 1, but CLAUDE.md is truncated to USER PREFIX\n<!-- aidd_projec. The original content is not restored.

AI tool

Other — direct invocation of the aidd-context project-memory sync script

aidd-cli version

Not applicable — the reproduction invokes the project-memory script directly; framework next is at b688e402.

OS

Linux

Additional context

PR #992 adds descriptor-based writes and safeguards against symlinks, hard links, and path substitution. Its injected write-failure test fails before the first byte; it does not cover a partial write followed by an error or a truncation failure. The PR also states that it does not guarantee recovery from every filesystem failure or atomicity across multiple files.

Code of Conduct

• I agree to follow this project's Code of Conduct.