refactor(fs): use mkdirSafe recursive and align test mocks

Replace try/access/mkdir pattern with single mkdirSafe call in ssh-key-manager; drop unused mkdir mocks from stt/tts/repo tests and mock fs-safe's mkdirSafe instead; add zod peer dep extension to pnpm workspace; note EACCES-tolerant startup in troubleshooting doc.

Author: chriswritescode-dev

backend/src/utils/ssh-key-manager.ts

@@ -9,11 +9,7 @@ import { mkdirSafe } from './fs-safe'
 const SSH_KEYS_DIR = join(getWorkspacePath(), '.ssh-keys')
 
 async function ensureSSHKeysDir(): Promise<void> {
-  try {
-    await fs.access(SSH_KEYS_DIR)
-  } catch {
-    await mkdirSafe(SSH_KEYS_DIR, { mode: 0o700 })
-  }
+  await mkdirSafe(SSH_KEYS_DIR, { mode: 0o700 })
 }
 
 async function validateSSHKey(keyPath: string): Promise<boolean> {
@@ -167,11 +163,7 @@ export function generateSSHConfig(entries: SSHConfigEntry[]): string {
 
 export async function writeSSHConfig(configPath: string, configContent: string): Promise<void> {
   const dir = join(getWorkspacePath(), 'config')
-  try {
-    await fs.access(dir)
-  } catch {
-    await mkdirSafe(dir, { mode: 0o700 })
-  }
+  await mkdirSafe(dir, { mode: 0o700 })
 
   await fs.writeFile(configPath, configContent, { mode: 0o600 })
 }

backend/test/routes/stt.test.ts

@@ -2,7 +2,6 @@ import { describe, it, expect, vi, beforeEach } from 'vitest'
 import * as fs from 'fs/promises'
 
 vi.mock('fs/promises', () => ({
-  mkdir: vi.fn(),
   readFile: vi.fn(),
   writeFile: vi.fn(),
   stat: vi.fn(),
@@ -45,7 +44,6 @@ vi.mock('@opencode-manager/shared/config/env', () => ({
   },
 }))
 
-const mockMkdir = fs.mkdir as any
 const mockReadFile = fs.readFile as any
 const mockWriteFile = fs.writeFile as any
 const mockStat = fs.stat as any
@@ -432,7 +430,6 @@ describe('STT Routes', () => {
         mtimeMs: Date.now() - 2 * 60 * 60 * 1000,
       })
       mockUnlink.mockResolvedValue(undefined)
-      mockMkdir.mockResolvedValue(undefined)
       mockWriteFile.mockResolvedValue(undefined)
 
       const mockFetch = vi.fn().mockResolvedValue({
@@ -461,7 +458,6 @@ describe('STT Routes', () => {
     it('should return default model when API fetch fails', async () => {
       const originalFetch = globalThis.fetch
       mockStat.mockRejectedValue(new Error('File not found'))
-      mockMkdir.mockResolvedValue(undefined)
       mockWriteFile.mockResolvedValue(undefined)
 
       const mockFetch = vi.fn().mockRejectedValue(new Error('Network error'))
@@ -479,7 +475,6 @@ describe('STT Routes', () => {
 
     it('should force refresh when refresh=true', async () => {
       const originalFetch = globalThis.fetch
-      mockMkdir.mockResolvedValue(undefined)
       mockWriteFile.mockResolvedValue(undefined)
 
       const mockFetch = vi.fn().mockResolvedValue({

backend/test/routes/tts.test.ts

@@ -2,7 +2,6 @@ import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import * as fs from 'fs/promises'
 
 vi.mock('fs/promises', () => ({
-  mkdir: vi.fn(),
   readFile: vi.fn(),
   writeFile: vi.fn(),
   readdir: vi.fn(),

backend/test/services/repo.test.ts

@@ -16,21 +16,25 @@ const deleteRepo = vi.fn()
 const lstat = vi.fn()
 const stat = vi.fn()
 const readdir = vi.fn()
-const mkdir = vi.fn()
 const symlink = vi.fn()
 const readlink = vi.fn()
+const mkdirSafe = vi.fn()
 
 vi.mock('fs/promises', () => ({
   default: {
     lstat,
     stat,
     readdir,
-    mkdir,
     symlink,
     readlink,
   },
 }))
 
+vi.mock('../../src/utils/fs-safe', () => ({
+  mkdirSafe,
+  mkdirSyncSafe: vi.fn(),
+}))
+
 vi.mock('../../src/utils/process', () => ({
   executeCommand,
 }))
@@ -84,7 +88,7 @@ describe('repo service', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     ensureDirectoryExists.mockResolvedValue(undefined)
-    mkdir.mockResolvedValue(undefined)
+    mkdirSafe.mockResolvedValue(undefined)
     symlink.mockResolvedValue(undefined)
     readlink.mockResolvedValue('')
     readdir.mockResolvedValue([])

docs/troubleshooting.md

@@ -48,6 +48,8 @@ ports:
 
 **Symptoms:** Container can't write to volumes
 
+Startup tolerates workspace directories that already exist with wrong ownership; permission errors then appear on the first write into the directory rather than at startup.
+
 **Solutions:**
 
 1. Fix ownership:

pnpm-lock.yaml

@@ -4,3 +4,11 @@ packages:
   - 'frontend'
   - 'ocm-cli'
   - '!workspace/**'
+
+packageExtensions:
+  '@hookform/resolvers':
+    peerDependencies:
+      zod: '*'
+    peerDependenciesMeta:
+      zod:
+        optional: true