Concurrent processes corrupt ~/.claude.json via unsynchronized read-modify-write

Description

Multiple concurrent Claude Code processes (VS Code extension + CLI instances) corrupt ~/.claude.json by performing unsynchronized read-modify-write cycles on the same file. There is no file locking, so processes race and overwrite each other's state.

Environment

• OS: Windows 11 Pro
• CLI version: 2.1.62
• VS Code extension version: 2.1.59

Evidence

1. File content changes between reads seconds apart

Two sequential reads of ~/.claude.json (36 seconds apart) returned completely different content — different userID, different structure, different file size. Another process overwrote the file in between.

2. Orphaned temp file from crashed write

Found .claude.json.tmp.9392.1767983889589 — a write-to-temp-then-rename that never completed because PID 9392 was killed mid-write. This confirms the atomic-write pattern is used, but the broader read-modify-write cycle is not synchronized.

3. Data loss — accumulated state wiped by fresh instance

• .claude.json.backup: 39 KB of accumulated state (88 startups, full tips history, cached gates, OAuth data, etc.)
• .claude.json (current): 530 bytes of minimal fresh state

A newly started Claude instance initializes with minimal state and writes it back, completely overwriting the accumulated state from other sessions.

4. Four concurrent processes targeting the same file

| PID | Source | Version |
|-----|--------|---------|
| 68940 | VS Code extension | 2.1.59 |
| 88408 | CLI (--dangerously-skip-permissions) | 2.1.62 |
| 52512 | CLI (--dangerously-skip-permissions) | 2.1.62 |
| 19060 | CLI (--dangerously-skip-permissions) | 2.1.62 |

The write path resolves to path.join(process.env.CLAUDE_CONFIG_DIR || os.homedir(), ".claude.json") — all instances resolve to the same file with no coordination.

Expected behavior

Concurrent Claude Code processes should not corrupt each other's config state. Options:

• File locking (e.g., proper-lockfile, OS-level advisory locks) around the read-modify-write cycle
• Per-process or per-PID isolation so transient subagent processes don't write to the shared config at all
• Merge-on-write instead of overwrite — read the current file state, merge changes, then write

Workaround

The CLAUDE_CONFIG_DIR environment variable can isolate instances, but this fragments config and is not a real solution. Reducing concurrent sessions mitigates but doesn't fix the race.

Steps to reproduce

1. Open Claude Code in VS Code
2. Open 2+ Claude Code CLI sessions in separate terminals
3. Use all sessions actively
4. Observe ~/.claude.json content changing unpredictably between reads
5. Kill a Claude process mid-operation and observe orphaned .claude.json.tmp.* files