feat(init): route every init write through one guarded path

[KuSh]

Summary

Every rtk init write now goes through one path in src/hooks/init/write.rs, with the checks each agent used to do (or skip) around it. A single plan_write decides, for each write, what it lands on, what refuses it, what must be confirmed and what happens to the backup; the write, the check made before a consent prompt and the --dry-run preview all read that one plan.

Four commits, each standing on its own:

1. fix(init): leave AGENTS.md alone on rtk init --codex --uninstall --dry-run — the dry run removed the rtk-instructions block for real.
2. fix(init): patch a ~/.trae-cn that links to ~/.trae only once — the second pass backed RTK's own write up over the user's hooks.json.bak.
3. fix(init): back up without following a symlink at the .bak — the copy goes to a temp file renamed over the .bak, so a planted symlink or hard link is replaced rather than written through. Fixes fs::copy onto a .bak path follows a symlink there, so a cloned repo can redirect rtk init writes outside the project #4157.
4. feat(init): route every init write through one guarded path:
   • RTK's own files (RTK.md, GEMINI.md, hooks, extensions, plugins including Antigravity's, the Kilo Code rules, filters templates): atomic, no backup.
   • Configs RTK edits (settings.json, hooks configs, hooks.toml, Hermes' config.yaml): <name>.bak, then atomic. Gemini's settings.json now gets a backup too.
   • Instruction files RTK adds to (CLAUDE.md, AGENTS.md, Copilot instructions, .clinerules, .windsurfrules): <name>.bak (an earlier one is kept), then written in place, so owner, group, ACLs and hard links survive.
   • Missing parent directories are created once, in the shared path; the per-agent create_dir_all blocks are gone.
   • A file this user cannot write is refused before any prompt or backup. A Claude, Gemini or Vibe config RTK cannot patch is left to the manual instructions in every mode instead of aborting the run.
   • On Unix, new and replaced files get the permission bits a plain write would (they were all 0600).
   • A dangling symlink is followed only when a plain write would (its directory exists); otherwise it is refused, never replaced by a regular file.
   • In project mode (rtk init --codex writes through a symlinked AGENTS.md, so a cloned repo can redirect the write outside the project #4156): hook configs and extensions of Codex, Copilot, Trae, Droid, Pi, OMP and Antigravity that resolve outside the project are refused, generalising the guard Codex already had. Any other project write that resolves outside the project, or edits a hard-linked file in place, is named first; --auto-patch writes it, the default mode asks, --no-patch or a non-interactive run refuses it. --codex now accepts --auto-patch / --no-patch for this.

Fixes #4156. Fixes #4157.

Behaviour changes worth knowing

• A non-interactive project rtk init stops when a file it would edit resolves outside the project (e.g. a CLAUDE.md linked to a shared copy), unless --auto-patch is given. A read-only file is refused in every mode.
• Patched files leave a <name>.bak next to them.
• A symlink into a directory that does not exist is refused instead of being replaced by a regular file.

Related PRs

• Supersedes fix(hooks): refuse symlinked backup destinations #4186 (thanks @Ha1baraA11): same goal as commit 3, done by renaming a temp file over the .bak instead of a no-follow open, which also covers hard links and needs no platform flags.
• Supersedes fix(codex): reject external AGENTS.md symlinks #4176: Codex's AGENTS.md gets the warn / ask / refuse policy above rather than a hard refusal.
• Will conflict with fix(hooks): harden Pi/OMP shared-extension ownership lifecycle #3875 (pi.rs, extension_paths_alias now uses the shared resolver) and fix(hooks): own Gemini hooks by exact command, not substring #4235 (gemini.rs).

Test plan

• cargo fmt --all && cargo clippy --all-targets && cargo test --all on each commit and on the head (4041 tests)
• cfg(windows) build cross-checked
• init tests also run as namespaced root (unshare -r), for CI containers running as root
• every behaviour added here has a test that fails when the behaviour is reverted
• rtk init matrix against develop: 8576 forms (every agent, scope, --uninstall, --auto-patch / --no-patch, --dry-run, -v) over 16 setups (empty home, user content, legacy blocks, dangling links, links out of the project for hook and instruction files, a shared directory, read-only files, aliased Pi/OMP and Trae CN, …): no crash, no write under --dry-run, no write outside the project without --auto-patch, and every other difference is one listed above

🤖 Generated with Claude Code

[rtk-wshm-sync-bot]

wshm · Automated triage by AI

📊 Automated PR Analysis

✨ Type	feature
🔴 Risk	high

Summary

Consolidates every file write performed by rtk init (across all supported agents) into a single guarded path with unified logic for backups, permission checks, symlink safety, and project-boundary enforcement. Bundles three related bug fixes (dry-run leaving stray edits, backup clobbering user files, symlink-following during backup) with a larger refactor that also adds new safety behavior for project-mode writes resolving outside the project.

Review Checklist

• Tests present
• Breaking change
• Docs updated

Linked issues: #4156, #4157

---

Analyzed automatically by wshm · This is an automated analysis, not a human review.