fix(web): implement atomic write for shared storage

Add atomic write for the shared storage file to prevent race conditions.
Write to a temp file with restricted permissions and atomically rename.
Apply 600 permissions to the final storage file when possible

packages/web/package.json

@@ -25,6 +25,7 @@
     "@fontsource/ibm-plex-mono": "^5.2.7",
     "@fontsource/ibm-plex-sans": "^5.1.1",
     "@ibm/plex": "^6.4.1",
+    "@octokit/rest": "^22.0.1",
     "@opencode-ai/sdk": "^1.1.19",
     "@radix-ui/react-collapsible": "^1.1.12",
     "@radix-ui/react-dialog": "^1.1.15",

packages/web/server/lib/github-auth.js

@@ -43,7 +43,17 @@ function readJsonFile() {
 
 function writeJsonFile(payload) {
   ensureStorageDir();
-  fs.writeFileSync(STORAGE_FILE, JSON.stringify(payload, null, 2), 'utf8');
+
+  // Atomic write so multiple OpenChamber instances can safely share the same file.
+  const tmpFile = `${STORAGE_FILE}.${process.pid}.${Date.now()}.tmp`;
+  fs.writeFileSync(tmpFile, JSON.stringify(payload, null, 2), 'utf8');
+  try {
+    fs.chmodSync(tmpFile, 0o600);
+  } catch {
+    // best-effort
+  }
+
+  fs.renameSync(tmpFile, STORAGE_FILE);
   try {
     fs.chmodSync(STORAGE_FILE, 0o600);
   } catch {