fix(extensions): rollback atomically moves the backup dir instead of copytree

The rollback recreated dest_dir then copytree(..., dirs_exist_ok=True)'d the
backup into it. copytree uses copy2, which follows a symlink at a config leaf —
so a leaf raced into the recreated dest_dir could redirect a preserved secret to
an external target (validating only the ancestor directory does not protect
leaf paths).

Instead, after _reset_dir(dest_dir) removes any occupant and the ancestor chain
is verified non-symlink, os.replace() atomically MOVES the whole backup directory
(which already holds real files written via _atomic_restore_config) into place.
There is no per-leaf copy step and no window where dest_dir exists with a raced
leaf, so rollback can no longer follow a leaf symlink. The consumed backup is
set to None so cleanup skips it.

Existing reinstall/rollback tests (copytree-failure, failed-restore, symlinked
dest_dir, file-at-dest) all pass (361).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: jawwad-ali

src/specify_cli/extensions/__init__.py

@@ -1577,32 +1577,36 @@ def install_from_directory(
                 self._atomic_restore_config(dest_dir / name, data, mode, atime, mtime)
             restored_ok = True
         except Exception:
-            # Roll the configs back into a clean, symlink-safe dest_dir from the
-            # durable backup so a failed reinstall leaves them intact, then
-            # re-raise the original error. Reset dest_dir (unlink a symlink /
-            # rmtree a real dir — surfacing failures, never ignore_errors) and
-            # recreate it under a verified non-symlink ancestor chain BEFORE
-            # copying, so recovery can never merge through a symlinked or
-            # partially-removed directory into an external target.
+            # Roll the configs back into place from the durable backup so a failed
+            # reinstall leaves them intact, then re-raise the original error.
+            # Reset dest_dir (unlink a symlink / rmtree a real dir — surfacing
+            # failures, never ignore_errors), verify its ancestor chain is not
+            # symlinked, then ATOMICALLY MOVE the whole backup directory into
+            # place with os.replace. The backup already holds real files written
+            # via _atomic_restore_config, so moving the directory wholesale avoids
+            # copytree's copy2 following a leaf symlink raced into the recreated
+            # dest_dir and writing a preserved secret to an external target.
             if backup_dir is not None:
                 try:
                     from ..shared_infra import _ensure_safe_shared_directory
                     self._reset_dir(dest_dir)
                     _ensure_safe_shared_directory(
                         self.project_root,
-                        dest_dir,
-                        create=True,
+                        dest_dir.parent,
+                        create=False,
                         context="extension directory",
                     )
-                    shutil.copytree(backup_dir, dest_dir, dirs_exist_ok=True)
+                    os.replace(backup_dir, dest_dir)
+                    backup_dir = None  # consumed by the move; nothing to clean up
                     restored_ok = True
                 except (OSError, ValueError):
                     # ValueError covers SymlinkedSharedPathError (a symlinked
                     # ancestor): leave the durable backup on disk for recovery.
                     restored_ok = False
             raise
         finally:
-            # Drop the backup only when the configs are provably in dest_dir.
+            # Drop the backup only when the configs are provably in dest_dir
+            # (a successful move sets backup_dir to None, so nothing to clean).
             if backup_dir is not None and restored_ok and backup_dir.exists():
                 shutil.rmtree(backup_dir, ignore_errors=True)