Severity: medium · Effort: s · Value: 4/5
acquireLock() / releaseLock() (src/state.ts:100-130) are defined but have zero call sites — verified via grep across src/ and test/. Concurrent install/update/rollback runs race on installed.json read-modify-write and backup dirs.
This is a regression of intent: issue #127 ("Concurrent installs corrupt backup/state") was closed via PR #138, which shipped the lock mechanism but never wired it into the command paths.
Fix sketch: wrap mutating commands in try { acquireLock(); ... } finally { releaseLock(); }; add a test that a second concurrent invocation fails fast with a clear "another sharekit is running (pid N)" error.
Found by: /backlog run 2026-07-03 (code-reviewer agent, orchestrator-confirmed zero callers).
Severity: medium · Effort: s · Value: 4/5
acquireLock()/releaseLock()(src/state.ts:100-130) are defined but have zero call sites — verified via grep across src/ and test/. Concurrentinstall/update/rollbackruns race oninstalled.jsonread-modify-write and backup dirs.This is a regression of intent: issue #127 ("Concurrent installs corrupt backup/state") was closed via PR #138, which shipped the lock mechanism but never wired it into the command paths.
Fix sketch: wrap mutating commands in
try { acquireLock(); ... } finally { releaseLock(); }; add a test that a second concurrent invocation fails fast with a clear "another sharekit is running (pid N)" error.Found by: /backlog run 2026-07-03 (code-reviewer agent, orchestrator-confirmed zero callers).