cool-workflow 0.1.82 → 0.1.84

package/dist/orchestrator.js

@@ -821,6 +821,7 @@ function formatHelp() {
         "",
         "Commands:",
         "  list",
+        "  doctor [--json]   (check your setup: Node, agent backend, git, writable state)",
         "  init <workflow-id> [--title TEXT] [--output PATH]",
         "  quickstart [app-id] [--repo PATH] [--question TEXT] [--agent-command CMD] [--once] [--preview]",
         "  plan <workflow-id> [--repo PATH] [--question TEXT] [--invariant TEXT]",
@@ -873,6 +874,18 @@ function formatHelp() {
         "  run search|list|show|resume|archive|rerun|export|import|verify-import [run-id|archive] [--scope repo|home] [--json]",
         "  queue add|list|drain|show [queue-id] [--repo PATH] [--priority N]",
         "  history [--scope repo|home] [--app ID] [--status STATE] [--json]",
+        "  audit-run <app-id> [--repo PATH] [--question TEXT] [--agent-command CMD]",
+        "  metrics show|summary <run-id> [--scope repo|home] [--json]",
+        "  telemetry verify <run-id> [--pubkey PEM|PATH] [--json]",
+        "  gc plan|run|verify [run-id] [--json]",
+        "  sched plan|lease|release|complete|reclaim|reset|policy [--json]",
+        "  migration list|check|prove [target] [--json]",
+        "  operator status|report <run-id> [--json]",
+        "  review status|policy <run-id> [--json]",
+        "  approve|reject|comment <kind> <run-id> <target-id> [--reason TEXT]",
+        "  handoff <kind> <run-id> <target-id> [--to ROLE]",
+        "  loop --prompt TEXT [--interval-minutes N]",
+        "  demo tamper",
         "  workbench view <run-id> [--json]",
         "  workbench serve [--port N] [--scope repo|home] [--once|--json]",
         ""

package/dist/reclamation/hash.js

@@ -0,0 +1,72 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sha256OfString = sha256OfString;
+exports.sha256OfFile = sha256OfFile;
+exports.dirBytes = dirBytes;
+exports.contentDigest = contentDigest;
+// Content addressing + byte measurement for run reclamation (NO `du` — in-process
+// only). Carved out of reclamation.ts (FreeBSD-audit god-module carve) so the pure
+// content-addressing leaf no longer sits inside the write-ahead reclamation
+// transaction. These are pure functions of their path/string inputs — no run
+// state, no module-level mutable state.
+//
+// BEHAVIOR-PRESERVING — pure code movement, zero logic change. reclamation.ts
+// re-exports the public symbols (sha256OfString/sha256OfFile/dirBytes) so the
+// module's surface stays byte-identical.
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const compare_1 = require("../compare");
+function sha256Hex(value) {
+    return node_crypto_1.default.createHash("sha256").update(value).digest("hex");
+}
+function sha256OfString(value) {
+    return `sha256:${sha256Hex(value)}`;
+}
+function sha256OfFile(file) {
+    return `sha256:${sha256Hex(node_fs_1.default.readFileSync(file))}`;
+}
+/** Walk a path and sum file sizes IN-PROCESS (no `du`). Returns 0 if absent. A
+ *  file returns its own size; a dir returns the recursive sum. */
+function dirBytes(p) {
+    let total = 0;
+    let stat;
+    try {
+        stat = node_fs_1.default.statSync(p);
+    }
+    catch {
+        return 0;
+    }
+    if (stat.isFile())
+        return stat.size;
+    if (!stat.isDirectory())
+        return 0;
+    for (const entry of node_fs_1.default.readdirSync(p, { withFileTypes: true })) {
+        total += dirBytes(node_path_1.default.join(p, entry.name));
+    }
+    return total;
+}
+/** Stable content digest of a path (file = its bytes; dir = digest over each
+ *  member's relative path + bytes, sorted). Lets the freed-manifest record a
+ *  single sha per freed dir. */
+function contentDigest(p) {
+    const stat = node_fs_1.default.statSync(p);
+    if (stat.isFile())
+        return sha256OfFile(p);
+    const parts = [];
+    const walk = (dir, rel) => {
+        for (const entry of node_fs_1.default.readdirSync(dir, { withFileTypes: true }).sort((a, b) => (0, compare_1.compareBytes)(a.name, b.name))) {
+            const abs = node_path_1.default.join(dir, entry.name);
+            const r = node_path_1.default.join(rel, entry.name);
+            if (entry.isDirectory())
+                walk(abs, r);
+            else
+                parts.push(`${r}:${sha256OfFile(abs)}`);
+        }
+    };
+    walk(p, "");
+    return sha256OfString(parts.join("\n"));
+}

package/dist/reclamation.js

@@ -29,10 +29,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ReclamationError = exports.ReclamationAbort = exports.SKELETON_REQUIRED_KEYS = void 0;
-exports.sha256OfString = sha256OfString;
-exports.sha256OfFile = sha256OfFile;
-exports.dirBytes = dirBytes;
+exports.dirBytes = exports.sha256OfFile = exports.sha256OfString = exports.ReclamationError = exports.ReclamationAbort = exports.SKELETON_REQUIRED_KEYS = void 0;
 exports.reclaimedLogPath = reclaimedLogPath;
 exports.loadReclamationLog = loadReclamationLog;
 exports.extractSkeleton = extractSkeleton;
@@ -49,9 +46,12 @@ exports.runReclamation = runReclamation;
 exports.reconstructArtifact = reconstructArtifact;
 exports.verifyReclamation = verifyReclamation;
 exports.dominantFailureCode = dominantFailureCode;
-const node_crypto_1 = __importDefault(require("node:crypto"));
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
+const hash_1 = require("./reclamation/hash");
+Object.defineProperty(exports, "dirBytes", { enumerable: true, get: function () { return hash_1.dirBytes; } });
+Object.defineProperty(exports, "sha256OfFile", { enumerable: true, get: function () { return hash_1.sha256OfFile; } });
+Object.defineProperty(exports, "sha256OfString", { enumerable: true, get: function () { return hash_1.sha256OfString; } });
 const multi_agent_eval_1 = require("./multi-agent-eval");
 const node_projection_1 = require("./node-projection");
 const node_snapshot_1 = require("./node-snapshot");
@@ -95,59 +95,6 @@ class ReclamationError extends Error {
     }
 }
 exports.ReclamationError = ReclamationError;
-// ---------------------------------------------------------------------------
-// Content addressing + byte measurement (NO `du` — in-process only).
-// ---------------------------------------------------------------------------
-function sha256Hex(value) {
-    return node_crypto_1.default.createHash("sha256").update(value).digest("hex");
-}
-function sha256OfString(value) {
-    return `sha256:${sha256Hex(value)}`;
-}
-function sha256OfFile(file) {
-    return `sha256:${sha256Hex(node_fs_1.default.readFileSync(file))}`;
-}
-/** Walk a path and sum file sizes IN-PROCESS (no `du`). Returns 0 if absent. A
- *  file returns its own size; a dir returns the recursive sum. */
-function dirBytes(p) {
-    let total = 0;
-    let stat;
-    try {
-        stat = node_fs_1.default.statSync(p);
-    }
-    catch {
-        return 0;
-    }
-    if (stat.isFile())
-        return stat.size;
-    if (!stat.isDirectory())
-        return 0;
-    for (const entry of node_fs_1.default.readdirSync(p, { withFileTypes: true })) {
-        total += dirBytes(node_path_1.default.join(p, entry.name));
-    }
-    return total;
-}
-/** Stable content digest of a path (file = its bytes; dir = digest over each
- *  member's relative path + bytes, sorted). Lets the freed-manifest record a
- *  single sha per freed dir. */
-function contentDigest(p) {
-    const stat = node_fs_1.default.statSync(p);
-    if (stat.isFile())
-        return sha256OfFile(p);
-    const parts = [];
-    const walk = (dir, rel) => {
-        for (const entry of node_fs_1.default.readdirSync(dir, { withFileTypes: true }).sort((a, b) => (0, compare_1.compareBytes)(a.name, b.name))) {
-            const abs = node_path_1.default.join(dir, entry.name);
-            const r = node_path_1.default.join(rel, entry.name);
-            if (entry.isDirectory())
-                walk(abs, r);
-            else
-                parts.push(`${r}:${sha256OfFile(abs)}`);
-        }
-    };
-    walk(p, "");
-    return sha256OfString(parts.join("\n"));
-}
 /** Persist a run's authoritative state.json DURABLY (atomic temp → fsync →
  *  rename). The re-point that scratch reclamation depends on MUST be persisted
  *  this way BEFORE any byte is freed — see prepareFree(). */
@@ -220,13 +167,13 @@ function digestEvidenceEntry(entry) {
         try {
             const stat = node_fs_1.default.statSync(candidatePath);
             if (stat.isFile())
-                return { ref, digest: sha256OfFile(candidatePath) };
+                return { ref, digest: (0, hash_1.sha256OfFile)(candidatePath) };
         }
         catch {
             /* fall through to locator digest */
         }
     }
-    return { ref, digest: sha256OfString(ref) };
+    return { ref, digest: (0, hash_1.sha256OfString)(ref) };
 }
 /** STEP 1: extract + seal the skeleton. Pure read over the run; never mutates. */
 function extractSkeleton(run) {
@@ -264,7 +211,7 @@ function extractSkeleton(run) {
         .map(([ref, digest]) => ({ ref, digest }))
         .sort((a, b) => (0, compare_1.compareBytes)(a.ref, b.ref));
     const eventLog = auditEventLogPath(run);
-    const auditLogDigest = node_fs_1.default.existsSync(eventLog) ? sha256OfFile(eventLog) : sha256OfString("");
+    const auditLogDigest = node_fs_1.default.existsSync(eventLog) ? (0, hash_1.sha256OfFile)(eventLog) : (0, hash_1.sha256OfString)("");
     const events = node_fs_1.default.existsSync(eventLog)
         ? node_fs_1.default
             .readFileSync(eventLog, "utf8")
@@ -284,18 +231,18 @@ function extractSkeleton(run) {
     const metricsReport = node_path_1.default.join(run.paths.runDir, "metrics", "metrics-report.json");
     const costRecord = {
         tasks: (run.tasks || []).map((task) => ({ taskId: task.id, model: task.usage?.model, source: task.usage?.source })),
-        metricsDigest: node_fs_1.default.existsSync(metricsReport) ? sha256OfFile(metricsReport) : undefined
+        metricsDigest: node_fs_1.default.existsSync(metricsReport) ? (0, hash_1.sha256OfFile)(metricsReport) : undefined
     };
     const collaboration = run.collaboration;
     const collaborationLog = {
-        digest: sha256OfString((0, multi_agent_eval_1.replayStableStringify)(collaboration || {})),
+        digest: (0, hash_1.sha256OfString)((0, multi_agent_eval_1.replayStableStringify)(collaboration || {})),
         approvals: collaboration?.approvals?.length || 0,
         comments: collaboration?.comments?.length || 0,
         handoffs: collaboration?.handoffs?.length || 0
     };
     // Empty (not a hash-of-empty) when state.json is absent, so the skeleton fails
     // closed — you cannot seal a run whose authoritative state is gone.
-    const stateDigest = node_fs_1.default.existsSync(run.paths.state) ? sha256OfFile(run.paths.state) : "";
+    const stateDigest = node_fs_1.default.existsSync(run.paths.state) ? (0, hash_1.sha256OfFile)(run.paths.state) : "";
     return {
         schemaVersion: 1,
         runId: run.id,
@@ -402,13 +349,13 @@ function buildReferenceGraph(run) {
  *  node-projection field set (node-projection.ts) so reconstruction matches
  *  node-snapshot.ts's body byte-for-byte — the projection can no longer drift. */
 function snapshotProjectionDigest(node) {
-    return sha256OfString((0, node_projection_1.nodeProjectionDigestInput)(node));
+    return (0, hash_1.sha256OfString)((0, node_projection_1.nodeProjectionDigestInput)(node));
 }
 /** Body digest of the RETAINED node (lives in state.json). The reconstruction
  *  verifier re-derives the projection from this retained input. Same shared field
  *  set / canonical bytes as snapshotProjectionDigest. */
 function nodeBodyDigest(node) {
-    return sha256OfString((0, node_projection_1.nodeProjectionDigestInput)(node));
+    return (0, hash_1.sha256OfString)((0, node_projection_1.nodeProjectionDigestInput)(node));
 }
 /** Build the retention plan: which paths are freeable under `policy`, of what
  *  kind, how many bytes, and the resulting capability downgrade. */
@@ -431,7 +378,7 @@ function planReclamation(run, policy = {}) {
             const resultsCopy = task?.resultPath;
             if (!resultNodeId || !resultsCopy || !node_fs_1.default.existsSync(resultsCopy))
                 continue;
-            const bytes = dirBytes(workerDir);
+            const bytes = (0, hash_1.dirBytes)(workerDir);
             if (bytes <= 0)
                 continue;
             freeable.push({
@@ -478,14 +425,14 @@ function planReclamation(run, policy = {}) {
                         continue; // source node gone → cannot reconstruct → retain
                     if (repointNodeIds.has(node.id))
                         continue; // body will be re-pointed → retain
-                    const bytes = dirBytes(snapFile);
+                    const bytes = (0, hash_1.dirBytes)(snapFile);
                     if (bytes <= 0)
                         continue;
                     const inputDigest = nodeBodyDigest(node);
                     const recipe = {
                         recipeKind: "node-snapshot-projection",
                         inputDigests: [inputDigest],
-                        inputsDigest: sha256OfString((0, multi_agent_eval_1.replayStableStringify)([inputDigest])),
+                        inputsDigest: (0, hash_1.sha256OfString)((0, multi_agent_eval_1.replayStableStringify)([inputDigest])),
                         expectDigest: snapshotProjectionDigest(node),
                         sourceRef: node.id
                     };
@@ -534,11 +481,11 @@ function planReclamation(run, policy = {}) {
     return { freeable, bytesToFree, byKind, capability, capabilityReason };
 }
 function policyDigestOf(policy) {
-    return sha256OfString((0, multi_agent_eval_1.replayStableStringify)(policy));
+    return (0, hash_1.sha256OfString)((0, multi_agent_eval_1.replayStableStringify)(policy));
 }
 /** genesis prevTombstoneHash = sha256 of the sealed skeleton. */
 function genesisPrevHash(skeleton) {
-    return sha256OfString((0, multi_agent_eval_1.replayStableStringify)(skeleton));
+    return (0, hash_1.sha256OfString)((0, multi_agent_eval_1.replayStableStringify)(skeleton));
 }
 /** The canonical bytes a tombstoneHash binds: freed-manifest + sealed skeleton +
  *  prevTombstoneHash + capability. Recomputed independently by `gc verify`. */
@@ -551,14 +498,14 @@ function tombstoneHashInput(t) {
         policyDigest: t.policyDigest,
         freed: t.freed.map((f) => ({ path: f.path, kind: f.kind, bytes: f.bytes, sha256: f.sha256, recipe: f.recipe || null })),
         bytesFreed: t.bytesFreed,
-        skeletonDigest: sha256OfString((0, multi_agent_eval_1.replayStableStringify)(t.skeleton)),
+        skeletonDigest: (0, hash_1.sha256OfString)((0, multi_agent_eval_1.replayStableStringify)(t.skeleton)),
         capability: t.capability,
         capabilityReason: t.capabilityReason,
         prevTombstoneHash: t.prevTombstoneHash
     });
 }
 function computeTombstoneHash(t) {
-    return sha256OfString(tombstoneHashInput(t));
+    return (0, hash_1.sha256OfString)(tombstoneHashInput(t));
 }
 function tombstoneId(seq) {
     // Deterministic (FreeBSD-audit L13): the chain POSITION, not a process-global
@@ -576,7 +523,7 @@ function buildTombstone(run, skeleton, plan, options = {}) {
         path: entry.path,
         kind: entry.kind,
         bytes: entry.bytes,
-        sha256: contentDigest(entry.absPath),
+        sha256: (0, hash_1.contentDigest)(entry.absPath),
         recipe: entry.recipe
     }));
     const base = {
@@ -685,7 +632,7 @@ function freeBulk(run, tombstone) {
     let freedBytes = 0;
     for (const entry of tombstone.freed) {
         const abs = node_path_1.default.join(runDir, entry.path);
-        const before = dirBytes(abs);
+        const before = (0, hash_1.dirBytes)(abs);
         node_fs_1.default.rmSync(abs, { recursive: true, force: true });
         freedBytes += before;
     }
@@ -774,15 +721,15 @@ function reconstructArtifact(run, recipe) {
     if (recipe.recipeKind === "node-snapshot-projection") {
         const node = (run.nodes || []).find((n) => n.id === recipe.sourceRef);
         if (!node) {
-            return { inputsDigest: sha256OfString("absent"), expectDigest: sha256OfString("absent") };
+            return { inputsDigest: (0, hash_1.sha256OfString)("absent"), expectDigest: (0, hash_1.sha256OfString)("absent") };
         }
         const inputDigest = nodeBodyDigest(node);
-        const inputsDigest = sha256OfString((0, multi_agent_eval_1.replayStableStringify)([inputDigest]));
+        const inputsDigest = (0, hash_1.sha256OfString)((0, multi_agent_eval_1.replayStableStringify)([inputDigest]));
         const expectDigest = snapshotProjectionDigest(node);
         return { inputsDigest, expectDigest };
     }
     // Unknown recipe kind → fail closed (digest can't match expectDigest).
-    return { inputsDigest: sha256OfString("unknown-recipe"), expectDigest: sha256OfString("unknown-recipe") };
+    return { inputsDigest: (0, hash_1.sha256OfString)("unknown-recipe"), expectDigest: (0, hash_1.sha256OfString)("unknown-recipe") };
 }
 /** Re-prove the whole reclamation chain for a run: skeleton schema-complete,
  *  tombstoneHash/prevTombstoneHash chain recomputed-and-untampered, and each

package/dist/run-registry/queue.js

@@ -33,15 +33,14 @@ function queueFilePath(host) {
 }
 function loadQueue(host) {
     const file = queueFilePath(host);
+    // Absent => empty queue. A present-but-corrupt queue must FAIL CLOSED rather
+    // than read as empty: silently draining to [] would lose every queued run and
+    // let scheduling/lease ops proceed as if the store were clean. readJson throws
+    // `Invalid JSON in <file>` on a present, unparseable store; let it propagate.
     if (!node_fs_1.default.existsSync(file))
         return [];
-    try {
-        const parsed = (0, state_1.readJson)(file);
-        return Array.isArray(parsed.entries) ? parsed.entries : [];
-    }
-    catch {
-        return [];
-    }
+    const parsed = (0, state_1.readJson)(file);
+    return Array.isArray(parsed.entries) ? parsed.entries : [];
 }
 function saveQueue(host, entries) {
     (0, state_1.writeJson)(queueFilePath(host), { schemaVersion: 1, entries }, { durable: true });

package/dist/run-registry.js

@@ -162,29 +162,36 @@ class RunRegistry {
         return node_path_1.default.join(this.homeRoot, "registry");
     }
     // ---- per-repo overlays (plain files) ------------------------------------
+    // Overlay reads distinguish ABSENT (clean default) from PRESENT-but-corrupt
+    // (fail closed). readJson throws `Invalid JSON in <file>` on a present file
+    // that won't parse; we let that propagate instead of swallowing it. Swallowing
+    // is the absent-vs-corrupt conflation telemetry-ledger.ts flags as the bug that
+    // "let a corrupt overlay verify green" — here it would silently un-archive every
+    // archived run / drop every provenance link. This is authoritative durable state.
+    // A present overlay must parse to a JSON OBJECT. readJson already fails closed
+    // on unparseable bytes; this catches the next shape over: valid JSON that is
+    // `null`, an array, or a scalar. Without it `parsed.archived` throws a cryptic
+    // TypeError (null) or silently reads `undefined` (array) and the whole registry
+    // scan breaks. Fail closed with a clear message instead.
+    requireOverlayObject(parsed, file) {
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            throw new Error(`Corrupt overlay ${file}: expected a JSON object, got ${Array.isArray(parsed) ? "array" : parsed === null ? "null" : typeof parsed}`);
+        }
+        return parsed;
+    }
     loadArchiveOverlay(repo) {
         const file = node_path_1.default.join(this.repoRegistryDir(repo), "archive.json");
         if (!node_fs_1.default.existsSync(file))
             return { schemaVersion: 1, archived: {} };
-        try {
-            const parsed = (0, state_1.readJson)(file);
-            return { schemaVersion: 1, archived: parsed.archived || {} };
-        }
-        catch {
-            return { schemaVersion: 1, archived: {} };
-        }
+        const parsed = this.requireOverlayObject((0, state_1.readJson)(file), file);
+        return { schemaVersion: 1, archived: parsed.archived || {} };
     }
     loadProvenanceOverlay(repo) {
         const file = node_path_1.default.join(this.repoRegistryDir(repo), "provenance.json");
         if (!node_fs_1.default.existsSync(file))
             return { schemaVersion: 1, links: {} };
-        try {
-            const parsed = (0, state_1.readJson)(file);
-            return { schemaVersion: 1, links: parsed.links || {} };
-        }
-        catch {
-            return { schemaVersion: 1, links: {} };
-        }
+        const parsed = this.requireOverlayObject((0, state_1.readJson)(file), file);
+        return { schemaVersion: 1, links: parsed.links || {} };
     }
     loadRepoOverlays(repo) {
         return {
@@ -203,15 +210,14 @@ class RunRegistry {
     }
     loadRepos() {
         const file = this.reposFilePath();
+        // Absent => no registered repos. Present-but-corrupt must fail closed: a
+        // swallowed parse error here silently drops every cross-repo root the
+        // operator registered, shrinking the home index to the current repo with no
+        // signal. Let readJson's `Invalid JSON` throw surface the corruption.
         if (!node_fs_1.default.existsSync(file))
             return { schemaVersion: 1, repos: [] };
-        try {
-            const parsed = (0, state_1.readJson)(file);
-            return { schemaVersion: 1, repos: Array.isArray(parsed.repos) ? parsed.repos : [] };
-        }
-        catch {
-            return { schemaVersion: 1, repos: [] };
-        }
+        const parsed = this.requireOverlayObject((0, state_1.readJson)(file), file);
+        return { schemaVersion: 1, repos: Array.isArray(parsed.repos) ? parsed.repos : [] };
     }
     /** Persisted union of registered repo roots and the current repo, deduped and
      *  sorted. Read-only: does NOT write repos.json (reads stay pure). */
@@ -745,9 +751,14 @@ class RunRegistry {
         // Record provenance in the per-repo overlay (derived metadata), NOT in the
         // original run's source state — the past is never mutated.
         const provFile = node_path_1.default.join(this.repoRegistryDir(original.repo), "provenance.json");
-        const provOverlay = this.loadProvenanceOverlay(original.repo);
-        provOverlay.links[newRun.id] = provenance;
-        (0, state_1.writeJson)(provFile, provOverlay, { durable: true });
+        // Lock the read-modify-write: a concurrent rerun/archive on the same repo
+        // overlay would otherwise last-writer-wins and drop a provenance link. The
+        // sibling writers (registerRepo, archive) already serialize via withFileLock.
+        (0, state_1.withFileLock)(provFile, () => {
+            const provOverlay = this.loadProvenanceOverlay(original.repo);
+            provOverlay.links[newRun.id] = provenance;
+            (0, state_1.writeJson)(provFile, provOverlay, { durable: true });
+        });
         return {
             schemaVersion: 1,
             originalRunId: runId,

package/dist/scheduler.js

@@ -16,6 +16,16 @@ class Scheduler {
         this.cwd = node_path_1.default.resolve(cwd);
         this.storePath = node_path_1.default.join(this.cwd, ".cw", "schedules", "tasks.json");
     }
+    // Every mutation is a cross-process read-modify-write of the one store file
+    // (the daemon polls `due` while CLI calls create/complete/delete concurrently).
+    // Without serialization two writers both load, both atomically rename their
+    // copy back, and the second silently clobbers the first's new task / status /
+    // history record. `locked` holds the same advisory lock the queue and
+    // reclamation stores already use. Reads (list/history) need no lock: the atomic
+    // rename means a reader always sees a whole old-or-new store.
+    locked(fn) {
+        return (0, state_1.withFileLock)(this.storePath, fn);
+    }
     create(options) {
         const kind = normalizeKind(options.kind);
         const now = new Date();
@@ -43,23 +53,30 @@ class Scheduler {
             maxRuns: numberOption(options.maxRuns),
             runCount: 0
         };
-        const store = this.load();
-        store.tasks.push(task);
-        this.save(store);
-        return task;
+        return this.locked(() => {
+            const store = this.load();
+            store.tasks.push(task);
+            this.save(store);
+            return task;
+        });
     }
     list(status) {
         const store = this.load();
         return status ? store.tasks.filter((task) => task.status === status) : store.tasks;
     }
     delete(id) {
-        const store = this.load();
-        const before = store.tasks.length;
-        store.tasks = store.tasks.filter((task) => task.id !== id);
-        this.save(store);
-        return { deleted: store.tasks.length !== before, id };
+        return this.locked(() => {
+            const store = this.load();
+            const before = store.tasks.length;
+            store.tasks = store.tasks.filter((task) => task.id !== id);
+            this.save(store);
+            return { deleted: store.tasks.length !== before, id };
+        });
     }
     due(now = new Date()) {
+        return this.locked(() => this.dueLocked(now));
+    }
+    dueLocked(now) {
         const store = this.load();
         let changed = false;
         for (const task of store.tasks) {
@@ -87,63 +104,71 @@ class Scheduler {
         return dueTasks;
     }
     complete(id, options = {}) {
-        const store = this.load();
-        const task = store.tasks.find((candidate) => candidate.id === id);
-        if (!task)
-            throw new Error(`Scheduled task not found: ${id}`);
-        const now = new Date();
-        task.runCount += 1;
-        task.lastRunAt = now.toISOString();
-        task.updatedAt = now.toISOString();
-        const maxRuns = numberOption(options.maxRuns) ?? task.maxRuns;
-        if (maxRuns !== undefined)
-            task.maxRuns = maxRuns;
-        if (task.kind === "reminder" || (task.maxRuns !== undefined && task.runCount >= task.maxRuns)) {
-            task.status = "completed";
-        }
-        else {
-            task.nextRunAt = computeNextRunAt(task, now).toISOString();
-        }
-        this.save(store);
-        return task;
+        return this.locked(() => {
+            const store = this.load();
+            const task = store.tasks.find((candidate) => candidate.id === id);
+            if (!task)
+                throw new Error(`Scheduled task not found: ${id}`);
+            const now = new Date();
+            task.runCount += 1;
+            task.lastRunAt = now.toISOString();
+            task.updatedAt = now.toISOString();
+            const maxRuns = numberOption(options.maxRuns) ?? task.maxRuns;
+            if (maxRuns !== undefined)
+                task.maxRuns = maxRuns;
+            if (task.kind === "reminder" || (task.maxRuns !== undefined && task.runCount >= task.maxRuns)) {
+                task.status = "completed";
+            }
+            else {
+                task.nextRunAt = computeNextRunAt(task, now).toISOString();
+            }
+            this.save(store);
+            return task;
+        });
     }
     pause(id) {
         return this.setStatus(id, "paused");
     }
     resume(id) {
-        const store = this.load();
-        const task = findTask(store, id);
-        const now = new Date();
-        task.status = "active";
-        task.updatedAt = now.toISOString();
-        if (new Date(task.nextRunAt).getTime() <= now.getTime()) {
-            task.nextRunAt = computeNextRunAt(task, now).toISOString();
-        }
-        this.save(store);
-        return task;
+        return this.locked(() => {
+            const store = this.load();
+            const task = findTask(store, id);
+            const now = new Date();
+            task.status = "active";
+            task.updatedAt = now.toISOString();
+            if (new Date(task.nextRunAt).getTime() <= now.getTime()) {
+                task.nextRunAt = computeNextRunAt(task, now).toISOString();
+            }
+            this.save(store);
+            return task;
+        });
     }
     runNow(id) {
-        const store = this.load();
-        const task = findTask(store, id);
-        const now = new Date();
-        task.lastDueAt = now.toISOString();
-        task.updatedAt = now.toISOString();
-        const record = createHistoryRecord(task, "started", this.cwd, now);
-        store.history.push(record);
-        this.save(store);
-        return record;
+        return this.locked(() => {
+            const store = this.load();
+            const task = findTask(store, id);
+            const now = new Date();
+            task.lastDueAt = now.toISOString();
+            task.updatedAt = now.toISOString();
+            const record = createHistoryRecord(task, "started", this.cwd, now);
+            store.history.push(record);
+            this.save(store);
+            return record;
+        });
     }
     history(id) {
         const store = this.load();
         return id ? store.history.filter((record) => record.scheduleId === id) : store.history;
     }
     setStatus(id, status) {
-        const store = this.load();
-        const task = findTask(store, id);
-        task.status = status;
-        task.updatedAt = new Date().toISOString();
-        this.save(store);
-        return task;
+        return this.locked(() => {
+            const store = this.load();
+            const task = findTask(store, id);
+            task.status = status;
+            task.updatedAt = new Date().toISOString();
+            this.save(store);
+            return task;
+        });
     }
     load() {
         if (!node_fs_1.default.existsSync(this.storePath))

package/dist/version.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MIN_SUPPORTED_RUN_STATE_SCHEMA_VERSION = exports.LEGACY_RUN_STATE_SCHEMA_VERSION = exports.CURRENT_RUN_STATE_SCHEMA_VERSION = exports.WORKFLOW_APP_SCHEMA_VERSION = exports.CURRENT_COOL_WORKFLOW_VERSION = void 0;
-exports.CURRENT_COOL_WORKFLOW_VERSION = "0.1.82";
+exports.CURRENT_COOL_WORKFLOW_VERSION = "0.1.84";
 exports.WORKFLOW_APP_SCHEMA_VERSION = 1;
 exports.CURRENT_RUN_STATE_SCHEMA_VERSION = 1;
 exports.LEGACY_RUN_STATE_SCHEMA_VERSION = 0;