fix(security): atomically replace generated index

[seonghobae]

Security defect

Protected master@25d6fc44840ec2c25f3778780b21fef594a01ba4 wrote a complete temporary index but replaced index.html with REPLACE_EXISTING only. The final replacement therefore did not request filesystem atomicity.

Test-first proof

Exact test-only head 7a87c542917148f642d901df9b90f4bd6f9b48ec defined the behavioral contract:

1. atomic replacement must be attempted first;
2. an unsupported atomic move must trigger one documented non-atomic fallback;
3. the fallback must replace an existing index with complete content.

Hosted RED: CI 31463228406, build job 93690798636, failed at compileTestKotlin because protected production exposed only the two-argument write_index_file and could not accept the move seam.

Narrow repair

Exact current head 71aae66fce10c6af067c4b095d8294458351fdf6:

• injects a default Files.move seam without changing callers;
• requests ATOMIC_MOVE alone, truthfully reflecting that Java ignores other options in atomic mode;
• falls back only for AtomicMoveNotSupportedException or FileAlreadyExistsException;
• documents that fallback REPLACE_EXISTING is non-atomic;
• tests replacement of a pre-existing index.html through both provider-specific failure paths;
• preserves the existing finally cleanup and rethrows unrelated I/O failures.

Exact-head evidence

Live base: master@25d6fc44840ec2c25f3778780b21fef594a01ba4
Ancestry: 4 ahead, 0 behind
Review threads: 0
CodeRabbit status: success

All repository-native exact-head gates are terminal success:

• CI / tests / JaCoCo verification 31464172277
• Security Scan 31464172328
• SAST Semgrep 31464172515

This current-base line supersedes the atomic-replacement semantics in stale #393 and #403. #409 remains distinct because it also contains separate post-listing directory-identity work. Organization review/policy remains separate from repository-native checks.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 23 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ad2bf04e-9095-466e-b9ae-71a2a11d94a7

📥 Commits

Reviewing files that changed from the base of the PR and between 25d6fc4 and 71aae66.

📒 Files selected for processing (2)

• src/main/kotlin/html4tree/main.kt
• src/test/kotlin/html4tree/MainTest.kt

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}