fix(qmd): write index.yml atomically

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

shared/qmd/qmd-config.mjs

@@ -1,8 +1,8 @@
 // shared/qmd/qmd-config.mjs — edits only the models: block of QMD's index.yml.
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { pathToFileURL } from 'node:url';
-import { MODELS, qmdConfigPath, qmdPackageDir } from './qmd-lib.mjs';
+import { MODELS, qmdConfigPath, qmdPackageDir, writeTextAtomic } from './qmd-lib.mjs';
 
 export function setModels(text, YAML) {
   const document = YAML.parseDocument(text || '');
@@ -49,8 +49,7 @@ async function main(action, argument) {
     if (mapping === undefined) throw new Error('restore-models needs a JSON value');
     next = restoreModels(current, YAML, mapping);
   } else next = unsetModels(current, YAML);
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, next);
+  writeTextAtomic(path, next);
 }
 
 if (import.meta.url === pathToFileURL(process.argv[1] || '').href) {

shared/qmd/qmd-lib.mjs

@@ -54,14 +54,19 @@ export function readJson(path, fallback) {
   }
 }
 
-// The state directory lives in the user profile; mode 0600 restricts the token on POSIX.
-export function writePrivateJson(path, value) {
+// Readers never see a half-written file: write a temp file next to the target, then rename it.
+export function writeTextAtomic(path, text, options = {}) {
   mkdirSync(dirname(path), { recursive: true });
   const temporary = `${path}.${process.pid}.tmp`;
-  writeFileSync(temporary, JSON.stringify(value, null, 2) + '\n', { mode: 0o600 });
+  writeFileSync(temporary, text, options);
   renameSync(temporary, path);
 }
 
+// The state directory lives in the user profile; mode 0600 restricts the token on POSIX.
+export function writePrivateJson(path, value) {
+  writeTextAtomic(path, JSON.stringify(value, null, 2) + '\n', { mode: 0o600 });
+}
+
 let cachedPackageDir;
 
 export function qmdPackageDir() {