From c7dc1a0173a14e9cb52adcb09ae566cf7eeb314a Mon Sep 17 00:00:00 2001
From: Hermes Agent <hermes@localhost>
Date: Wed, 12 Aug 2026 06:02:57 +0000
Subject: Protect companion manifests from overwrite

---
 src/manifest.rs | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

(limited to 'src/manifest.rs')

diff --git a/src/manifest.rs b/src/manifest.rs
index 0848a98..4cd256c 100644
--- a/src/manifest.rs
+++ b/src/manifest.rs
@@ -1,6 +1,6 @@
 use std::collections::{BTreeMap, HashSet};
 use std::fs;
-use std::io::Read;
+use std::io::{Read, Write};
 use std::os::unix::fs::MetadataExt;
 use std::path::{Path, PathBuf};
 
@@ -51,7 +51,13 @@ impl ArtifactManifest {
     pub fn write_beside(&self, artifact: impl AsRef<Path>) -> Result<PathBuf> {
         let path = Self::path_beside(artifact)?;
         let text = toml::to_string_pretty(self).context("serialize artifact manifest")?;
-        fs::write(&path, text).with_context(|| format!("write artifact manifest {}", path.display()))?;
+        fs::OpenOptions::new()
+            .write(true)
+            .create_new(true)
+            .open(&path)
+            .with_context(|| format!("create artifact manifest {}", path.display()))?
+            .write_all(text.as_bytes())
+            .with_context(|| format!("write artifact manifest {}", path.display()))?;
         Ok(path)
     }
 
-- 
cgit v1.2.3