Preserve rescued extension config across retry

Assisted-by: GitHub Copilot (model: MAI-Code-1-Flash, autonomous)
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: mnriem

src/specify_cli/extensions/__init__.py

@@ -9,6 +9,7 @@
 from __future__ import annotations
 
 import copy
+import errno
 import hashlib
 import json
 import os
@@ -102,23 +103,46 @@ def _load_core_command_names() -> frozenset[str]:
 CORE_COMMAND_NAMES = _load_core_command_names()
 
 
+def _fsync_fd(fd: int) -> None:
+    """Sync a file descriptor, raising on real storage errors."""
+    try:
+        os.fsync(fd)
+    except AttributeError:
+        return
+    except NotImplementedError:
+        return
+    except OSError as exc:
+        if exc.errno in {errno.ENOTSUP, errno.EOPNOTSUPP, errno.EINVAL, errno.EBADF}:
+            return
+        raise
+
+
 def _fsync_directory(path: Path) -> None:
-    """Best-effort fsync for a directory path."""
+    """Sync a directory when the platform supports it."""
     if not path.exists():
         return
     try:
         dir_fd = os.open(str(path), os.O_RDONLY | getattr(os, "O_DIRECTORY", 0))
-    except (AttributeError, OSError, NotImplementedError):
+    except (AttributeError, NotImplementedError):
+        return
+    except OSError as exc:
+        if exc.errno in {errno.ENOTSUP, errno.EOPNOTSUPP, errno.EINVAL, errno.EBADF}:
+            return
         try:
             dir_fd = os.open(str(path), os.O_RDONLY)
-        except (AttributeError, OSError, NotImplementedError):
+        except (AttributeError, NotImplementedError):
             return
+        except OSError as exc2:
+            if exc2.errno in {errno.ENOTSUP, errno.EOPNOTSUPP, errno.EINVAL, errno.EBADF}:
+                return
+            raise
     try:
-        os.fsync(dir_fd)
-    except (AttributeError, OSError, NotImplementedError):
-        pass
+        _fsync_fd(dir_fd)
     finally:
-        os.close(dir_fd)
+        try:
+            os.close(dir_fd)
+        except OSError:
+            pass
 
 
 class ExtensionError(Exception):
@@ -1515,10 +1539,7 @@ def install_from_directory(
                                 staged.chmod(stat.S_IMODE(mode))
                             except (NotImplementedError, OSError):
                                 pass  # Best-effort; chmod may not be supported on all platforms.
-                        try:
-                            os.fsync(fd)
-                        except (AttributeError, OSError, NotImplementedError):
-                            pass
+                        _fsync_fd(fd)
                     finally:
                         os.close(fd)
                 # Write the completion marker only after every staged file is
@@ -1529,9 +1550,7 @@ def install_from_directory(
                     0o600,
                 )
                 try:
-                    os.fsync(marker_fd)
-                except (AttributeError, OSError, NotImplementedError):
-                    pass
+                    _fsync_fd(marker_fd)
                 finally:
                     os.close(marker_fd)
                 _fsync_directory(rescue_staging_dir)
@@ -1566,11 +1585,27 @@ def _restore_stranded_config_file(
                 ) as tmp:
                     tmp_path = Path(tmp.name)
                     tmp.write(content)
+                    tmp.flush()
+                    _fsync_fd(tmp.fileno())
                 try:
                     tmp_path.chmod(stat.S_IMODE(preserved_mode))
                 except (NotImplementedError, OSError):
                     pass  # Best-effort; chmod may not be supported on all platforms.
                 os.replace(tmp_path, target)
+                try:
+                    target_fd = os.open(str(target), os.O_RDONLY)
+                except (AttributeError, OSError, NotImplementedError):
+                    target_fd = None
+                try:
+                    if target_fd is not None:
+                        _fsync_fd(target_fd)
+                finally:
+                    if target_fd is not None:
+                        try:
+                            os.close(target_fd)
+                        except OSError:
+                            pass
+                _fsync_directory(target.parent)
             except BaseException:
                 if tmp_path is not None and tmp_path.exists():
                     tmp_path.unlink()

tests/test_extensions.py

@@ -22,6 +22,7 @@
 from unittest.mock import MagicMock
 
 from tests.conftest import strip_ansi
+import specify_cli.extensions as _ext_module
 from specify_cli.extensions import (
     CatalogEntry,
     CORE_COMMAND_NAMES,
@@ -1408,6 +1409,12 @@ def flaky_copytree(*args, **kwargs):
         assert (staging_dir / ".rescue-complete").exists()
         assert (staging_dir / "test-ext-config.yml").exists()
 
+        # Corrupt the rollback-restored copy to prove the next retry must rely
+        # on the durable staging backup, not whatever was written to dest_dir
+        # by the earlier failed install attempt.
+        config_file.write_text("model: wrong-model\n", encoding="utf-8")
+        assert config_file.read_bytes() != original_bytes
+
         manifest = manager.install_from_directory(
             extension_dir, "0.1.0", register_commands=False
         )