fix: ensure copyDirectory atomically copies files

Assisted-by: Claude Opus 4.6
Signed-off-by: David Sanders <dsanders11@ucsbalum.com>

Author: dsanders11

lib/copy-directory.js

@@ -3,9 +3,7 @@
 const { promises: fs } = require('graceful-fs')
 const path = require('path')
 
-const { backOff } = require('exponential-backoff')
-
-async function copyDirectory (src, dest, ensure = false) {
+async function copyDirectory (src, dest) {
   try {
     await fs.stat(src)
   } catch {
@@ -14,27 +12,43 @@ async function copyDirectory (src, dest, ensure = false) {
   await fs.mkdir(dest, { recursive: true })
   const entries = await fs.readdir(src, { withFileTypes: true })
   for (const entry of entries) {
-    if (entry.isDirectory()) {
-      await copyDirectory(path.join(src, entry.name), path.join(dest, entry.name))
-    } else if (entry.isFile()) {
-      // with parallel installs, copying files may cause file errors on
-      // Windows so use an exponential backoff to resolve collisions
-      await backOff(async () => {
+    if (!entry.isDirectory() && !entry.isFile()) {
+      throw new Error('Unexpected file directory entry type')
+    }
+
+    // With parallel installs, multiple processes race to place the same
+    // entry. Use fs.rename for an atomic move so no process ever sees a
+    // partially written file. For cross-filesystem (EXDEV), copy to a
+    // temp path in the dest directory first, then rename within the
+    // same filesystem to keep it atomic.
+    //
+    // When another process wins the race, rename may fail with one of
+    // these codes — all mean the destination was already placed and
+    // are safe to ignore since every process extracts identical content.
+    const raceErrors = ['ENOTEMPTY', 'EEXIST', 'EBUSY', 'EPERM']
+    const srcPath = path.join(src, entry.name)
+    const destPath = path.join(dest, entry.name)
+    try {
+      await fs.rename(srcPath, destPath)
+    } catch (err) {
+      if (raceErrors.includes(err.code)) {
+        // Another parallel process already placed this entry — ignore
+      } else if (err.code === 'EXDEV') {
+        // Cross-filesystem: copy to a uniquely named temp path in the
+        // dest directory, then rename into place atomically
+        const tmpPath = `${destPath}.tmp.${crypto.randomBytes(6).toString('hex')}`
         try {
-          await fs.copyFile(path.join(src, entry.name), path.join(dest, entry.name))
-        } catch (err) {
-          // if ensure, check if file already exists and that's good enough
-          if (ensure && err.code === 'EBUSY') {
-            try {
-              await fs.stat(path.join(dest, entry.name))
-              return
-            } catch {}
+          await fs.cp(srcPath, tmpPath, { recursive: true })
+          await fs.rename(tmpPath, destPath)
+        } catch (e) {
+          await fs.rm(tmpPath, { recursive: true, force: true }).catch(() => {})
+          if (!raceErrors.includes(e.code)) {
+            throw e
           }
-          throw err
         }
-      })
-    } else {
-      throw new Error('Unexpected file directory entry type')
+      } else {
+        throw err
+      }
     }
   }
 }

package.json

@@ -23,7 +23,6 @@
   "main": "./lib/node-gyp.js",
   "dependencies": {
     "env-paths": "^2.2.0",
-    "exponential-backoff": "^3.1.1",
     "graceful-fs": "^4.2.6",
     "make-fetch-happen": "^15.0.0",
     "nopt": "^9.0.0",