Fix config.json permission denied on HF Spaces persistent storage

On HuggingFace Spaces, the persistent /data volume may retain files owned by root or a different UID after container rebuilds, causing permission denied when ds2api tries to save config changes.

Two-layer fix:
- entrypoint.sh: always chown+chmod config files on startup, not just when creating them for the first time
- Go writeConfigBytes: atomic write (temp file + rename) with fallback that removes the old file and retries if permission denied

entrypoint.sh

@@ -9,14 +9,19 @@ fi
 # Create config file if not exists or is empty (with empty JSON object)
 if [ ! -f /data/config.json ] || [ ! -s /data/config.json ]; then
   echo {} > /data/config.json
-  chown ds2api:ds2api /data/config.json 2>/dev/null || true
 fi
+# Always ensure config.json is writable by ds2api user, even if the file
+# was created by a previous container with different ownership (common on
+# HuggingFace Spaces persistent storage after rebuild).
+chown ds2api:ds2api /data/config.json 2>/dev/null || true
+chmod 644 /data/config.json 2>/dev/null || true
 
 # Create chat history file if not exists or is empty
 if [ ! -f /data/chat_history.json ] || [ ! -s /data/chat_history.json ]; then
   echo {} > /data/chat_history.json
-  chown ds2api:ds2api /data/chat_history.json 2>/dev/null || true
 fi
+chown ds2api:ds2api /data/chat_history.json 2>/dev/null || true
+chmod 644 /data/chat_history.json 2>/dev/null || true
 
 # Start the application as ds2api user
 exec gosu ds2api /usr/local/bin/ds2api

internal/config/store.go

@@ -136,7 +136,7 @@ func loadConfigFromFile(path string) (Config, error) {
 	cfg.DropInvalidAccounts()
 	if strings.Contains(string(content), `"test_status"`) && !IsVercel() {
 		if b, err := json.MarshalIndent(cfg, "", "  "); err == nil {
-			_ = os.WriteFile(path, b, 0o644)
+			_ = overwriteFile(path, b, 0o644)
 		}
 	}
 	return cfg, nil

internal/config/store_env_writeback.go

@@ -36,13 +36,63 @@ func writeConfigFile(path string, cfg Config) error {
 	return writeConfigBytes(path, b)
 }
 
+// overwriteFile writes data to path. If the write fails due to permission
+// issues (common on HuggingFace Spaces where the file may be owned by root),
+// it removes the old file and retries.
+func overwriteFile(path string, b []byte, perm os.FileMode) error {
+	if err := os.WriteFile(path, b, perm); err != nil {
+		if removeErr := os.Remove(path); removeErr == nil {
+			return os.WriteFile(path, b, perm)
+		}
+		return err
+	}
+	return nil
+}
+
 func writeConfigBytes(path string, b []byte) error {
 	dir := filepath.Dir(path)
 	if dir == "." || dir == "" {
-		return os.WriteFile(path, b, 0o644)
+		return overwriteFile(path, b, 0o644)
 	}
 	if err := os.MkdirAll(dir, 0o755); err != nil {
 		return fmt.Errorf("mkdir config dir: %w", err)
 	}
-	return os.WriteFile(path, b, 0o644)
+	// Write to a temp file first, then rename atomically to avoid
+	// leaving a corrupted/truncated config on crash or disk-full.
+	tmp, err := os.CreateTemp(dir, ".ds2api-config-*")
+	if err != nil {
+		return fmt.Errorf("create temp config file: %w", err)
+	}
+	tmpName := tmp.Name()
+	wrote := false
+	defer func() {
+		if !wrote {
+			_ = tmp.Close()
+			_ = os.Remove(tmpName)
+		}
+	}()
+	if _, err := tmp.Write(b); err != nil {
+		return fmt.Errorf("write temp config: %w", err)
+	}
+	if err := tmp.Sync(); err != nil {
+		return fmt.Errorf("sync temp config: %w", err)
+	}
+	if err := tmp.Close(); err != nil {
+		return fmt.Errorf("close temp config: %w", err)
+	}
+	wrote = true
+	if err := os.Rename(tmpName, path); err != nil {
+		// Rename may fail because the existing file has wrong ownership/permissions
+		// (common on HuggingFace Spaces where /data/config.json may be owned by root).
+		// Try removing the old file and renaming again.
+		if removeErr := os.Remove(path); removeErr == nil {
+			if renameErr := os.Rename(tmpName, path); renameErr == nil {
+				return nil
+			}
+		}
+		// Rename still failing (e.g. cross-filesystem); fall back to direct write.
+		_ = os.Remove(tmpName)
+		return overwriteFile(path, b, 0o644)
+	}
+	return nil
 }