fix: eliminate TOCTOU race and path traversal in realtime save handler

[hacktron-app-stg]

Vulnerability

realtime.js handled save messages by checking fs.existsSync(path) and then calling fs.writeFileSync(path, ...) as two separate, non-atomic steps. Between the check and the write an attacker with local/shared-environment access could replace the target path with a symlink, causing the write to follow the link and overwrite arbitrary files writable by the Node process (TOCTOU). The destination was also built by string-concatenating unsanitized data.name onto /srv/cache/, permitting directory traversal.

Fix

• Perform the create-and-write atomically with fs.writeFileSync(path, data.body, { flag: 'wx' }). The wx flag maps to O_CREAT | O_EXCL, which atomically fails if the path exists and refuses to follow a final symlink — removing the check/act window while preserving the original "only write if it doesn't already exist" semantics (an EEXIST error is treated as a no-op).
• Validate data.name: it must be a non-empty string equal to its own path.basename, rejecting .., path separators, and non-string inputs. The path is assembled with path.join(CACHE_DIR, name).

Verification

• node --check realtime.js passes.
• Reasoned through the exploit: the atomic wx open removes the separate existence check, and basename validation blocks traversal, so neither the symlink swap nor ../ escape is possible.

No test infrastructure exists in the repo, so no automated regression test was added.

---

Automated fix by Hacktron for finding: https://staging.hacktron.ai/testestesttest/findings/47b7e2ec-f464-4ba4-852c-5594a99642bc