fix: relocate yargs shim generation to local directory and handle stream error callbacks in File.ts

Author: thiyaguk09

handwritten/storage/scripts/preload-yargs.cjs

@@ -1,16 +1,18 @@
 const Module = require('module');
 const fs = require('fs');
 const path = require('path');
-const os = require('os');
 
 const originalResolveFilename = Module._resolveFilename;
 
 Module._resolveFilename = function(request, parent, isMain, options) {
   if (request === 'yargs/yargs') {
     const resolved = originalResolveFilename.apply(this, arguments);
-    // Create a unique shim file in tmpdir based on the exact path to avoid collisions
+    if (resolved.endsWith('.mjs')) {
+      return resolved;
+    }
+    // Create a unique shim file in the local scripts directory to avoid shared temp directory vulnerabilities
     const safeHash = Buffer.from(resolved).toString('base64').replace(/[^a-zA-Z0-9]/g, '');
-    const shimPath = path.join(os.tmpdir(), `yargs-shim-${safeHash}.cjs`);
+    const shimPath = path.join(__dirname, `yargs-shim-${safeHash}.cjs`);
 
     if (!fs.existsSync(shimPath)) {
       const content = fs.readFileSync(resolved, 'utf8');

handwritten/storage/src/file.ts

@@ -2188,13 +2188,25 @@ class File extends ServiceObject<File, FileMetadata> {
       emitStream.removeListener('error', noop);
 
       if (fileWriteStream.destroyed) {
-        fileWriteStream.once('error', (err: Error) => {
-          pipelineCallback(err);
-        });
-        // Call pipelineCallback immediately if there's no error to wait for,
-        // though duplexify might emit error on next tick.
-        // Also cleanup emitStream since pipeline won't do it.
+        let callbackCalled = false;
+        const onError = (err: Error) => {
+          if (!callbackCalled) {
+            callbackCalled = true;
+            pipelineCallback(err);
+          }
+        };
+        fileWriteStream.once('error', onError);
         emitStream.destroy();
+
+        process.nextTick(() => {
+          fileWriteStream.removeListener('error', onError);
+          if (!callbackCalled) {
+            callbackCalled = true;
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            const err = (fileWriteStream as any).errored || new Error('Write stream destroyed');
+            pipelineCallback(err);
+          }
+        });
         return;
       }