chainlesschain 0.162.94 → 0.162.96

package/src/lib/agent-core.js

@@ -1,8 +1,4 @@
-/**
- * @deprecated Re-export shim; canonical impl is `../runtime/agent-core.js`
- * (CLI Runtime Convergence, Phase 6b). Import from there in new code.
- */
-
+/** @deprecated Thin re-export shim; canonical impl is `../runtime/agent-core.js` (CLI Runtime Convergence, Phase 6b) — import from there in new code. */
 export {
   AGENT_TOOLS,
   AGENT_TOOL_REGISTRY,
@@ -33,6 +29,7 @@ export {
   _streamErrorDisposition,
   _isRetryableStreamError,
   _retryStreamingChat,
+  _iterateStreamWithStall,
   _toAnthropicMessages,
   _anthropicThinkingParams,
   _normalizeAnthropicResponse,

package/src/lib/audit-mtc.js

@@ -22,6 +22,7 @@ import path from "node:path";
 import crypto from "node:crypto";
 import { ed25519 as nobleEd25519 } from "@noble/curves/ed25519.js";
 import mtcLib from "@chainlesschain/core-mtc";
+import { withFileLock } from "./with-file-lock.js";
 
 const { sha256, jcs, encodeHashStr, ed25519, assembleBatch } = mtcLib;
 
@@ -70,6 +71,30 @@ function ensureDirs(dir) {
   }
 }
 
+/**
+ * Atomically write a UTF-8 file (temp sibling + rename). Used for the config
+ * and per-event staging records: a crash mid-write would truncate config.json
+ * or leave a partial event that closeBatch silently drops as malformed. Temp
+ * names end in `.tmp` (never `.json`), so a hard-crash leftover is ignored by
+ * listStagingEvents' `.json` filter. NOTE: the issuer key (flag "wx" exclusive
+ * create) and closeBatch (whole tmp-dir rename) have their own atomicity and
+ * are intentionally left untouched.
+ */
+function atomicWriteFileSync(filePath, data) {
+  const tmp = `${filePath}.${process.pid}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+  try {
+    fs.writeFileSync(tmp, data, "utf-8");
+    fs.renameSync(tmp, filePath);
+  } catch (err) {
+    try {
+      if (fs.existsSync(tmp)) fs.unlinkSync(tmp);
+    } catch {
+      /* best-effort temp cleanup */
+    }
+    throw err;
+  }
+}
+
 // ─────────────────────────────────────────────────────────────────────
 // Config
 // ─────────────────────────────────────────────────────────────────────
@@ -107,7 +132,7 @@ export function saveAuditMtcConfig(dir, patch) {
   if (typeof merged.issuer !== "string" || !merged.issuer) {
     throw new TypeError("config.issuer must be non-empty string");
   }
-  fs.writeFileSync(configPath(dir), JSON.stringify(merged, null, 2), "utf-8");
+  atomicWriteFileSync(configPath(dir), JSON.stringify(merged, null, 2));
   return merged;
 }
 
@@ -227,7 +252,7 @@ export function emitEvent(dir, body, opts = {}) {
   };
 
   const filePath = path.join(stagingDir(dir), `${eventId}.json`);
-  fs.writeFileSync(filePath, JSON.stringify(record, null, 2), "utf-8");
+  atomicWriteFileSync(filePath, JSON.stringify(record, null, 2));
   return { eventId, path: filePath, record };
 }
 
@@ -293,6 +318,19 @@ function listStagingEvents(dir) {
  * @param {string} [opts.issuer]    - override config.issuer
  */
 export function closeBatch(dir, opts = {}) {
+  // Serialize the whole staging-scan → batch-write → staging-cleanup section
+  // across processes. Without it, two concurrent closes (e.g. overlapping
+  // `cc audit mtc reconcile` runs) both scan the same staging events, allocate
+  // the same batch id, and the defensive rmSync(finalDir) lets the second
+  // silently overwrite the first's audit batch. Best-effort lock (never hangs);
+  // generous timeout since the section includes Merkle assembly + signing.
+  ensureDirs(dir);
+  return withFileLock(batchesDir(dir), () => _closeBatchImpl(dir, opts), {
+    timeoutMs: 15000,
+  });
+}
+
+function _closeBatchImpl(dir, opts = {}) {
   ensureDirs(dir);
   const cfg = loadAuditMtcConfig(dir);
   const events = listStagingEvents(dir);

package/src/lib/chat-core.js

@@ -11,6 +11,11 @@
 
 import { BUILT_IN_PROVIDERS } from "./llm-providers.js";
 import { appendTokenUsage } from "../harness/jsonl-session-store.js";
+import {
+  isRetryableStreamError,
+  STREAM_RETRY_MAX,
+  STREAM_RETRY_BASE_MS,
+} from "./stream-retry.js";
 
 // A streaming chat call must not hang forever if the API accepts the connection
 // but then goes silent (TCP up, no bytes). Abort the request if no data arrives
@@ -19,18 +24,43 @@ import { appendTokenUsage } from "../harness/jsonl-session-store.js";
 // generous (and env-overridable) so a slow local model's first token isn't cut
 // off; raise CC_CHAT_STALL_MS if you run very large local models.
 export const STREAM_STALL_MS = Number(process.env.CC_CHAT_STALL_MS) || 180000;
+// Before the hard abort above, surface a "waiting for API response" hint once
+// per silent gap (cc agent parity — agent-core STREAM_STALL_MS). Purely
+// informational; never aborts. Env-overridable; disabled if it would exceed the
+// abort threshold.
+export const STREAM_STALL_HINT_MS =
+  Number(process.env.CC_CHAT_STALL_HINT_MS) || 20000;
 
-function makeStallGuard(stallMs = STREAM_STALL_MS) {
+function makeStallGuard(
+  stallMs = STREAM_STALL_MS,
+  { onHint, hintMs = STREAM_STALL_HINT_MS } = {},
+) {
   const controller = new AbortController();
   let timer = null;
+  let hintTimer = null;
+  const hintArmed =
+    typeof onHint === "function" && hintMs > 0 && hintMs < stallMs;
   const bump = () => {
     if (timer) clearTimeout(timer);
     timer = setTimeout(() => controller.abort(), stallMs);
     if (timer && typeof timer.unref === "function") timer.unref();
+    if (hintArmed) {
+      if (hintTimer) clearTimeout(hintTimer);
+      hintTimer = setTimeout(() => {
+        try {
+          onHint(hintMs);
+        } catch {
+          /* hint is best-effort — never affect the stream */
+        }
+      }, hintMs);
+      if (hintTimer && typeof hintTimer.unref === "function") hintTimer.unref();
+    }
   };
   const stop = () => {
     if (timer) clearTimeout(timer);
+    if (hintTimer) clearTimeout(hintTimer);
     timer = null;
+    hintTimer = null;
   };
   return {
     signal: controller.signal,
@@ -40,13 +70,35 @@ function makeStallGuard(stallMs = STREAM_STALL_MS) {
   };
 }
 
+// OpenAI-compatible cached-prompt-token count (mirrors agent-core's
+// _openaiCachedTokens). OpenAI/volcengine report it as
+// usage.prompt_tokens_details.cached_tokens; DeepSeek as
+// usage.prompt_cache_hit_tokens. prompt_tokens INCLUDES the cached count, so
+// callers subtract it to recover uncached input (avoids over-pricing in
+// `cc cost` for cc chat sessions).
+function _cachedPromptTokens(usage) {
+  if (!usage || typeof usage !== "object") return 0;
+  const detailed = Number(usage.prompt_tokens_details?.cached_tokens);
+  if (Number.isFinite(detailed) && detailed > 0) return detailed;
+  const deepseek = Number(usage.prompt_cache_hit_tokens);
+  if (Number.isFinite(deepseek) && deepseek > 0) return deepseek;
+  return 0;
+}
+
 /**
  * Stream a response from Ollama.
  * If `onUsage` is provided, it's called with `{inputTokens, outputTokens}`
  * derived from Ollama's terminal `prompt_eval_count` / `eval_count` fields.
  */
-export async function streamOllama(messages, model, baseUrl, onToken, onUsage) {
-  const guard = makeStallGuard();
+export async function streamOllama(
+  messages,
+  model,
+  baseUrl,
+  onToken,
+  onUsage,
+  onStall,
+) {
+  const guard = makeStallGuard(STREAM_STALL_MS, { onHint: onStall });
   guard.bump();
   let response;
   try {
@@ -129,8 +181,9 @@ export async function streamOpenAI(
   apiKey,
   onToken,
   onUsage,
+  onStall,
 ) {
-  const guard = makeStallGuard();
+  const guard = makeStallGuard(STREAM_STALL_MS, { onHint: onStall });
   guard.bump();
   let response;
   try {
@@ -189,10 +242,14 @@ export async function streamOpenAI(
               onToken(content);
             }
             if (json.usage && onUsage) {
-              const inputTokens = Number(json.usage.prompt_tokens) || 0;
+              // Split cached prompt tokens out of prompt_tokens so cc cost
+              // prices the cached prefix correctly (matches agent-core).
+              const cacheReadTokens = _cachedPromptTokens(json.usage);
+              const prompt = Number(json.usage.prompt_tokens) || 0;
+              const inputTokens = Math.max(0, prompt - cacheReadTokens);
               const outputTokens = Number(json.usage.completion_tokens) || 0;
-              if (inputTokens || outputTokens) {
-                onUsage({ inputTokens, outputTokens });
+              if (inputTokens || outputTokens || cacheReadTokens) {
+                onUsage({ inputTokens, outputTokens, cacheReadTokens });
               }
             }
           } catch {
@@ -224,6 +281,7 @@ export async function streamAnthropic(
   apiKey,
   onToken,
   onUsage,
+  onStall,
 ) {
   // Split out a leading system prompt (Anthropic requires it as top-level
   // `system`, not an OpenAI-style role=system message).
@@ -237,7 +295,7 @@ export async function streamAnthropic(
     }
   }
 
-  const guard = makeStallGuard();
+  const guard = makeStallGuard(STREAM_STALL_MS, { onHint: onStall });
   guard.bump();
   let response;
   try {
@@ -279,6 +337,8 @@ export async function streamAnthropic(
   let buf = "";
   let inputTokens = 0;
   let outputTokens = 0;
+  let cacheReadTokens = 0;
+  let cacheCreationTokens = 0;
 
   try {
     while (true) {
@@ -302,10 +362,13 @@ export async function streamAnthropic(
               onToken(delta);
             }
           } else if (obj.type === "message_start") {
-            inputTokens =
-              Number(obj.message?.usage?.input_tokens) || inputTokens;
-            outputTokens =
-              Number(obj.message?.usage?.output_tokens) || outputTokens;
+            const u = obj.message?.usage || {};
+            inputTokens = Number(u.input_tokens) || inputTokens;
+            outputTokens = Number(u.output_tokens) || outputTokens;
+            cacheReadTokens =
+              Number(u.cache_read_input_tokens) || cacheReadTokens;
+            cacheCreationTokens =
+              Number(u.cache_creation_input_tokens) || cacheCreationTokens;
           } else if (obj.type === "message_delta") {
             outputTokens = Number(obj.usage?.output_tokens) || outputTokens;
           }
@@ -324,8 +387,16 @@ export async function streamAnthropic(
     guard.stop();
   }
 
-  if (onUsage && (inputTokens || outputTokens)) {
-    onUsage({ inputTokens, outputTokens });
+  if (
+    onUsage &&
+    (inputTokens || outputTokens || cacheReadTokens || cacheCreationTokens)
+  ) {
+    onUsage({
+      inputTokens,
+      outputTokens,
+      cacheReadTokens,
+      cacheCreationTokens,
+    });
   }
 
   return fullResponse;
@@ -362,7 +433,12 @@ export async function* chatStream(messages, options) {
     waiter = null;
     w();
   };
+  // Count of tokens the provider has actually emitted this turn. A connection
+  // drop is only safe to retry while this is 0 — once any token has been
+  // streamed, re-issuing would duplicate visible output.
+  let tokensEmitted = 0;
   const onToken = (token) => {
+    tokensEmitted++;
     queue.push(token);
     wake();
   };
@@ -376,7 +452,7 @@ export async function* chatStream(messages, options) {
   let providerCall;
   if (provider === "ollama") {
     providerCall = () =>
-      streamOllama(messages, model, baseUrl, onToken, onUsage);
+      streamOllama(messages, model, baseUrl, onToken, onUsage, options.onStall);
   } else if (provider === "anthropic") {
     const providerDef = BUILT_IN_PROVIDERS.anthropic;
     const url =
@@ -392,7 +468,15 @@ export async function* chatStream(messages, options) {
       );
     }
     providerCall = () =>
-      streamAnthropic(messages, model, url, key, onToken, onUsage);
+      streamAnthropic(
+        messages,
+        model,
+        url,
+        key,
+        onToken,
+        onUsage,
+        options.onStall,
+      );
   } else {
     const providerDef = BUILT_IN_PROVIDERS[provider];
     const url =
@@ -408,7 +492,15 @@ export async function* chatStream(messages, options) {
       );
     }
     providerCall = () =>
-      streamOpenAI(messages, model, url, key, onToken, onUsage);
+      streamOpenAI(
+        messages,
+        model,
+        url,
+        key,
+        onToken,
+        onUsage,
+        options.onStall,
+      );
   }
 
   // Run the provider stream concurrently with the queue-drain loop. finally
@@ -416,7 +508,36 @@ export async function* chatStream(messages, options) {
   // any token still terminates the generator cleanly.
   const streamPromise = (async () => {
     try {
-      return await providerCall();
+      let attempt = 0;
+      for (;;) {
+        try {
+          return await providerCall();
+        } catch (err) {
+          // Retry ONLY a transient connection drop that hit before any token
+          // reached the user (tokensEmitted === 0) — otherwise the re-issue
+          // would duplicate the visible answer. Mirrors agent-core's
+          // zero-output retry safety (cc agent parity). Stall aborts (180s) and
+          // HTTP/auth errors are not retryable and surface immediately.
+          if (
+            attempt >= STREAM_RETRY_MAX ||
+            tokensEmitted > 0 ||
+            !isRetryableStreamError(err)
+          ) {
+            throw err;
+          }
+          attempt++;
+          if (typeof options.onStreamRetry === "function") {
+            try {
+              options.onStreamRetry(attempt, err);
+            } catch {
+              /* retry notice is best-effort */
+            }
+          }
+          await new Promise((r) =>
+            setTimeout(r, STREAM_RETRY_BASE_MS * 2 ** (attempt - 1)),
+          );
+        }
+      }
     } finally {
       done = true;
       wake();
@@ -451,6 +572,8 @@ export async function* chatStream(messages, options) {
         usage: {
           input_tokens: capturedUsage.inputTokens,
           output_tokens: capturedUsage.outputTokens,
+          cache_read_input_tokens: capturedUsage.cacheReadTokens || 0,
+          cache_creation_input_tokens: capturedUsage.cacheCreationTokens || 0,
         },
       });
     } catch {

package/src/lib/claude-code-bridge.js

@@ -120,6 +120,11 @@ export class ClaudeCodeAgent extends EventEmitter {
       const startTime = Date.now();
       const outputChunks = [];
       const errorChunks = [];
+      // Streaming decoders so a multi-byte UTF-8 char split across two stdout/
+      // stderr chunks is reassembled, not corrupted into U+FFFD (in both the
+      // live `output` emit and the final join).
+      const outDecoder = new TextDecoder("utf-8");
+      const errDecoder = new TextDecoder("utf-8");
       let timedOut = false;
 
       const proc = _deps.spawn(this.cliCommand, args, {
@@ -145,13 +150,20 @@ export class ClaudeCodeAgent extends EventEmitter {
       }, timeout);
 
       proc.stdout.on("data", (data) => {
-        const chunk = data.toString("utf8");
+        const chunk =
+          typeof data === "string"
+            ? data
+            : outDecoder.decode(data, { stream: true });
         outputChunks.push(chunk);
         this.emit("output", { agentId: this.id, chunk });
       });
 
       proc.stderr.on("data", (data) => {
-        errorChunks.push(data.toString("utf8"));
+        errorChunks.push(
+          typeof data === "string"
+            ? data
+            : errDecoder.decode(data, { stream: true }),
+        );
       });
 
       proc.on("close", (code) => {

package/src/lib/cli-anything-bridge.js

@@ -258,6 +258,11 @@ module.exports = {
   async execute(task, context) {
     const input = (task?.params?.input || task?.action || "").trim();
     if (!input) return { success: false, error: "No input provided" };
+    // Security: input is interpolated into a shell command, so reject shell
+    // metacharacters to prevent command injection from untrusted skill input.
+    if (/[;&|\`$<>()\\n\\r]/.test(input)) {
+      return { success: false, error: "Input contains unsafe shell characters; refused." };
+    }
     try {
       const output = execSync(\`${command} \${input}\`, {
         encoding: "utf-8",

package/src/lib/cli-numeric.js

@@ -0,0 +1,38 @@
+/**
+ * cli-numeric — validated parsing for user-supplied numeric CLI options.
+ *
+ * `parseInt`/`Number` on a bad arg yields NaN that silently corrupts whatever
+ * consumes it (a `LIMIT NaN`, a `Date.now()+NaN` deadline, a stored NaN config).
+ * This centralizes parse → validate → fall-back-or-throw so a command either
+ * fails LOUDLY with a clear message or falls back to a sane default — never
+ * threads NaN downstream.
+ *
+ * @param {*} raw  the option value (string from commander, or undefined)
+ * @param {object} [opts]
+ * @param {string} [opts.name="value"]   label for error messages (e.g. "--limit")
+ * @param {boolean} [opts.integer=false] parse as integer (parseInt) vs float (Number)
+ * @param {number} [opts.min]            inclusive lower bound
+ * @param {number} [opts.max]            inclusive upper bound
+ * @param {number} [opts.fallback]       returned for missing/invalid input; when
+ *                                       omitted, invalid input THROWS instead
+ * @returns {number}
+ */
+export function numericOption(raw, opts = {}) {
+  const { name = "value", integer = false, min, max } = opts;
+  const hasFallback = Object.prototype.hasOwnProperty.call(opts, "fallback");
+  const fail = (msg) => {
+    if (hasFallback) return opts.fallback;
+    throw new Error(msg);
+  };
+
+  if (raw == null || raw === "") return fail(`${name} is required`);
+  const n = integer ? parseInt(raw, 10) : Number(raw);
+  if (!Number.isFinite(n)) {
+    return fail(
+      `${name} must be a ${integer ? "whole " : ""}number (got ${JSON.stringify(String(raw))})`,
+    );
+  }
+  if (min != null && n < min) return fail(`${name} must be >= ${min}`);
+  if (max != null && n > max) return fail(`${name} must be <= ${max}`);
+  return n;
+}

package/src/lib/config-manager.js

@@ -1,7 +1,15 @@
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
+import {
+  readFileSync,
+  writeFileSync,
+  existsSync,
+  mkdirSync,
+  renameSync,
+  unlinkSync,
+} from "node:fs";
 import { dirname } from "node:path";
 import { getConfigPath } from "./paths.js";
 import { DEFAULT_CONFIG } from "../constants.js";
+import { withFileLock } from "./with-file-lock.js";
 
 export function loadConfig() {
   const configPath = getConfigPath();
@@ -20,7 +28,24 @@ export function loadConfig() {
 export function saveConfig(config) {
   const configPath = getConfigPath();
   mkdirSync(dirname(configPath), { recursive: true });
-  writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
+  // Atomic write: config.json holds API keys + LLM settings, so a crash (or two
+  // concurrent `cc config set`) mid-write must never leave a truncated/corrupt
+  // file — that would break every cc command and could lose credentials. Write a
+  // temp sibling, then rename over the target (rename is atomic within a
+  // filesystem), so a reader/crash sees either the old file or the complete new
+  // one, never a half-written one.
+  const tmp = `${configPath}.${process.pid}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+  try {
+    writeFileSync(tmp, JSON.stringify(config, null, 2) + "\n", "utf-8");
+    renameSync(tmp, configPath);
+  } catch (err) {
+    try {
+      if (existsSync(tmp)) unlinkSync(tmp);
+    } catch {
+      /* best-effort temp cleanup */
+    }
+    throw err;
+  }
 }
 
 export function getConfigValue(key) {
@@ -29,10 +54,16 @@ export function getConfigValue(key) {
 }
 
 export function setConfigValue(key, value) {
-  const config = loadConfig();
-  setNestedValue(config, key, parseValue(value));
-  saveConfig(config);
-  return config;
+  // Serialize the read-modify-write across processes: two concurrent
+  // `cc config set` invocations would otherwise each load, mutate, and write
+  // back, silently losing one update. Best-effort lock (see with-file-lock):
+  // on contention timeout it proceeds anyway, so the CLI never hangs.
+  return withFileLock(getConfigPath(), () => {
+    const config = loadConfig();
+    setNestedValue(config, key, parseValue(value));
+    saveConfig(config);
+    return config;
+  });
 }
 
 export function resetConfig() {

package/src/lib/cowork/ab-comparator-cli.js

@@ -160,13 +160,17 @@ REASON: (1-2 sentence justification)`;
   };
 }
 
-function parseScores(text, variants, criteria) {
+export function parseScores(text, variants, criteria) {
   const scores = [];
   for (let i = 0; i < variants.length; i++) {
     const variantScores = {};
     for (const c of criteria) {
+      // The criterion is matched LITERALLY — escape regex metacharacters so a
+      // name like "latency(ms)" or "f.score" doesn't silently mis-parse (and an
+      // unbalanced one like "a)b(" doesn't throw and crash the whole compare).
+      const cEsc = String(c).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
       const pattern = new RegExp(
-        `variant\\s*${i + 1}[^\\n]*${c}\\s*=\\s*(\\d+)`,
+        `variant\\s*${i + 1}[^\\n]*${cEsc}\\s*=\\s*(\\d+)`,
         "i",
       );
       const match = text.match(pattern);

package/src/lib/cowork-cron.js

@@ -32,6 +32,7 @@
 import crypto from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+import { withFileLock } from "./with-file-lock.js";
 
 export const _deps = {
   existsSync,
@@ -260,49 +261,59 @@ export function addSchedule(cwd, input) {
   const err = validateCron(cron);
   if (err) throw new Error(`invalid cron: ${err}`);
 
-  const schedules = loadSchedules(cwd);
-  const entry = {
-    id: `sch-${crypto.randomUUID().slice(0, 12)}`,
-    cron: cron.trim(),
-    templateId,
-    userMessage,
-    files: Array.isArray(files) ? files : [],
-    enabled: true,
-    createdAt: _deps.now().toISOString(),
-    lastRunAt: null,
-    lastStatus: null,
-  };
-  schedules.push(entry);
-  saveSchedules(cwd, schedules);
-  return entry;
+  // Serialize the read-modify-write across processes (cc+cc / cc+desktop share
+  // the cowork dir) so concurrently-added schedules don't clobber each other.
+  return withFileLock(_scheduleFile(cwd), () => {
+    const schedules = loadSchedules(cwd);
+    const entry = {
+      id: `sch-${crypto.randomUUID().slice(0, 12)}`,
+      cron: cron.trim(),
+      templateId,
+      userMessage,
+      files: Array.isArray(files) ? files : [],
+      enabled: true,
+      createdAt: _deps.now().toISOString(),
+      lastRunAt: null,
+      lastStatus: null,
+    };
+    schedules.push(entry);
+    saveSchedules(cwd, schedules);
+    return entry;
+  });
 }
 
 export function removeSchedule(cwd, id) {
-  const schedules = loadSchedules(cwd);
-  const idx = schedules.findIndex((s) => s.id === id);
-  if (idx === -1) return false;
-  schedules.splice(idx, 1);
-  saveSchedules(cwd, schedules);
-  return true;
+  return withFileLock(_scheduleFile(cwd), () => {
+    const schedules = loadSchedules(cwd);
+    const idx = schedules.findIndex((s) => s.id === id);
+    if (idx === -1) return false;
+    schedules.splice(idx, 1);
+    saveSchedules(cwd, schedules);
+    return true;
+  });
 }
 
 export function setScheduleEnabled(cwd, id, enabled) {
-  const schedules = loadSchedules(cwd);
-  const s = schedules.find((x) => x.id === id);
-  if (!s) return false;
-  s.enabled = !!enabled;
-  saveSchedules(cwd, schedules);
-  return true;
+  return withFileLock(_scheduleFile(cwd), () => {
+    const schedules = loadSchedules(cwd);
+    const s = schedules.find((x) => x.id === id);
+    if (!s) return false;
+    s.enabled = !!enabled;
+    saveSchedules(cwd, schedules);
+    return true;
+  });
 }
 
 export function updateScheduleRunState(cwd, id, { lastRunAt, lastStatus }) {
-  const schedules = loadSchedules(cwd);
-  const s = schedules.find((x) => x.id === id);
-  if (!s) return false;
-  if (lastRunAt) s.lastRunAt = lastRunAt;
-  if (lastStatus) s.lastStatus = lastStatus;
-  saveSchedules(cwd, schedules);
-  return true;
+  return withFileLock(_scheduleFile(cwd), () => {
+    const schedules = loadSchedules(cwd);
+    const s = schedules.find((x) => x.id === id);
+    if (!s) return false;
+    if (lastRunAt) s.lastRunAt = lastRunAt;
+    if (lastStatus) s.lastStatus = lastStatus;
+    saveSchedules(cwd, schedules);
+    return true;
+  });
 }
 
 // ─── Scheduler ───────────────────────────────────────────────────────────────