From 2eb6cb2c068dd301ee42bdb28fb62a3d4d4a3acc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E9=9B=B7=E7=94=B5=E8=8A=BD=E8=A1=A3?=
 <zhangyanghaha0407@outlook.com>
Date: Thu, 16 Apr 2026 22:49:22 -0400
Subject: [PATCH] fix(db): move active runs query into deleteTask transaction
 (P1-12 TOCTOU)

---
 src/main/database/tasks-crud.ts | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/src/main/database/tasks-crud.ts b/src/main/database/tasks-crud.ts
index 8f279914..35ea3be4 100644
--- a/src/main/database/tasks-crud.ts
+++ b/src/main/database/tasks-crud.ts
@@ -116,16 +116,16 @@ export function buildTaskCrudMethods(
     },
 
     deleteTask(id: string, companyId: string): void {
-      const activeTaskRuns = readAll<{
-        id: string;
-        taskId: string;
-        workspaceId: string | null;
-      }>(
-        "select id, task_id as taskId, workspace_id as workspaceId from runs where task_id = ? and company_id = ? and status in ('queued', 'running')",
-        id,
-        companyId,
-      );
       transaction(() => {
+        const activeTaskRuns = getDb()
+          .prepare(
+            "select id, task_id as taskId, workspace_id as workspaceId from runs where task_id = ? and company_id = ? and status in ('queued', 'running')",
+          )
+          .all(id, companyId) as Array<{
+          id: string;
+          taskId: string;
+          workspaceId: string | null;
+        }>;
         for (const run of activeTaskRuns) {
           const ts = nowIso();
           getDb()