From 1659ed00115169eb00f153d18d78e30297866d25 Mon Sep 17 00:00:00 2001
From: Rip&Tear <84775494+theCyberTech@users.noreply.github.com>
Date: Thu, 25 Jun 2026 09:23:39 +0800
Subject: [PATCH] Close temp fd on secure settings write failure

---
 lib/crewai-core/src/crewai_core/settings.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/crewai-core/src/crewai_core/settings.py b/lib/crewai-core/src/crewai_core/settings.py
index c54f2ddb6..5405cb977 100644
--- a/lib/crewai-core/src/crewai_core/settings.py
+++ b/lib/crewai-core/src/crewai_core/settings.py
@@ -50,12 +50,19 @@ def _ensure_dir_mode(directory: Path) -> None:
 def _write_secure_json(path: Path, data: dict[str, Any]) -> None:
     """Atomically write ``data`` as JSON to ``path`` with owner-only (0o600) mode."""
     fd, tmp = tempfile.mkstemp(dir=path.parent, prefix=f".{path.name}.")
+    fd_open = True
     try:
         with os.fdopen(fd, "w") as f:
+            fd_open = False
             json.dump(data, f, indent=4)
         os.chmod(tmp, 0o600)
         os.replace(tmp, path)
     except BaseException:
+        if fd_open:
+            try:
+                os.close(fd)
+            except OSError:
+                pass
         if os.path.exists(tmp):
             os.unlink(tmp)
         raise