fix(vault): create the vault directory before writing (fixes "io error" on first run) (#127)

On a fresh install the platform config dir (e.g. ~/.config/cairn) does not
exist until something writes there. Vault creation — triggered the first time
a credential is saved, e.g. adding an SSH host with a password — failed with a
raw "io error" because `NamedTempFile::new_in` cannot create its temp file in
a missing directory. Both vault write paths (`atomic_create` and `atomic_write`)
now ensure the parent directory exists first via a shared `ensure_parent_dir`
helper, which sets a directory it creates to owner-only 0700 on Unix (the vault
file itself is already 0600). A pre-existing user directory is left untouched.

Regression test: `Vault::create` into a path whose parent is missing now
succeeds and yields a 0700 directory.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: zoza1982

CHANGELOG.md

@@ -91,6 +91,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- **Creating the vault no longer fails with "io error" on a fresh install.** The vault's config
+  directory (e.g. `~/.config/cairn`) does not exist until something writes there, and vault creation
+  (triggered the first time you save a credential — e.g. adding an SSH host with a password) failed
+  because the atomic write couldn't create its temp file in a missing directory. Vault writes now
+  create the parent directory first (owner-only `0700` on Unix). Regression test added.
+
 - **Panes now root at the OS filesystem root** (`/` on Unix, drive root on Windows) so `..`
   navigation is unrestricted all the way up. Cairn still opens at the launch directory, but
   the user can navigate above it without hitting an artificial ceiling. The `LocalVfs` base is

crates/cairn-vault/src/lib.rs

@@ -404,10 +404,37 @@ fn parse(bytes: &[u8]) -> Result<Parsed<'_>, VaultError> {
     })
 }
 
+/// Resolve `path`'s parent directory, creating it (and any missing ancestors) if absent.
+///
+/// The vault file's containing directory (the platform config dir, e.g. `~/.config/cairn`) does
+/// not exist on a fresh install, and `NamedTempFile::new_in` fails with a raw I/O error ("io
+/// error") if it is missing — so both write paths must ensure it exists first. A directory we
+/// create here is set owner-only (`0700`) on Unix, since it holds the encrypted vault; a directory
+/// the user already set up is left untouched.
+fn ensure_parent_dir(path: &Path) -> Result<PathBuf, VaultError> {
+    let dir = path
+        .parent()
+        .unwrap_or_else(|| Path::new("."))
+        .to_path_buf();
+    // Sampled before the create so the chmod below only tightens a dir we made. Bound under
+    // `cfg(unix)` because that block is its only reader — otherwise it's unused on Windows and
+    // trips `-D warnings`.
+    #[cfg(unix)]
+    let newly_created = !dir.exists();
+    std::fs::create_dir_all(&dir)?;
+    #[cfg(unix)]
+    if newly_created {
+        use std::os::unix::fs::PermissionsExt;
+        // Best-effort: never fail the write over a permission tweak on a dir we just made.
+        let _ = std::fs::set_permissions(&dir, std::fs::Permissions::from_mode(0o700));
+    }
+    Ok(dir)
+}
+
 fn atomic_write(path: &Path, bytes: &[u8]) -> Result<(), VaultError> {
     use std::io::Write;
-    let dir = path.parent().unwrap_or_else(|| Path::new("."));
-    let mut tmp = tempfile::NamedTempFile::new_in(dir)?;
+    let dir = ensure_parent_dir(path)?;
+    let mut tmp = tempfile::NamedTempFile::new_in(&dir)?;
     tmp.write_all(bytes)?;
     tmp.as_file().sync_all()?;
     tmp.persist(path).map_err(|e| VaultError::Io(e.error))?;
@@ -423,8 +450,8 @@ fn atomic_write(path: &Path, bytes: &[u8]) -> Result<(), VaultError> {
 /// receive the same sentinel as the pre-flight check, not a raw I/O error.
 fn atomic_create(path: &Path, bytes: &[u8]) -> Result<(), VaultError> {
     use std::io::Write;
-    let dir = path.parent().unwrap_or_else(|| Path::new("."));
-    let mut tmp = tempfile::NamedTempFile::new_in(dir)?;
+    let dir = ensure_parent_dir(path)?;
+    let mut tmp = tempfile::NamedTempFile::new_in(&dir)?;
     tmp.write_all(bytes)?;
     tmp.as_file().sync_all()?;
     tmp.persist_noclobber(path).map_err(|e| {
@@ -564,6 +591,36 @@ mod tests {
         ));
     }
 
+    /// Regression: on a fresh install the platform config dir (e.g. `~/.config/cairn`) does not
+    /// exist yet, and `Vault::create` used to fail with a raw "io error" because
+    /// `NamedTempFile::new_in` can't create a temp file in a nonexistent directory. The create path
+    /// must now create the parent directory itself (owner-only `0700` on Unix).
+    #[test]
+    fn create_succeeds_when_the_parent_directory_is_missing() {
+        let base = tempfile::tempdir().unwrap();
+        let path = base
+            .path()
+            .join("does")
+            .join("not")
+            .join("exist")
+            .join("vault.cvlt");
+        assert!(!path.parent().unwrap().exists());
+        let vault = Vault::create_with_params(&path, &pass("pw"), KdfParams::fast_for_tests())
+            .expect("create must succeed into a missing dir");
+        assert!(path.exists(), "vault file must be written");
+        // The created vault directory is owner-only (0700) on Unix.
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            let mode = std::fs::metadata(path.parent().unwrap())
+                .unwrap()
+                .permissions()
+                .mode();
+            assert_eq!(mode & 0o777, 0o700, "created vault dir must be 0700");
+        }
+        drop(vault);
+    }
+
     /// Regression test for the create-path clobber window (Fix 2): `atomic_create` must return
     /// `VaultError::AlreadyExists` and leave the existing file byte-for-byte intact.
     ///