fix: guard fcntl.flock(LOCK_UN) with try/except OSError in finally blocks#20529
Closed
vominh1919 wants to merge 1 commit into
Closed
fix: guard fcntl.flock(LOCK_UN) with try/except OSError in finally blocks#20529vominh1919 wants to merge 1 commit into
vominh1919 wants to merge 1 commit into
Conversation
…ocks fcntl.flock(fd, LOCK_UN) can raise OSError (e.g. EBADF on an already-closed fd) in finally blocks. When this happens, the exception replaces the original exception being propagated, making debugging much harder, and the subsequent fd.close() is skipped, leaving the lock held forever. Fixed 5 locations across the codebase: - tools/memory_tool.py (memory file locking) - tools/environments/file_sync.py (sync-back file locking) - cron/scheduler.py (cron job singleton lock) - agent/shell_hooks.py (shell allowlist locking) - hermes_cli/auth.py (auth store locking) The msvcrt (Windows) unlock path was already guarded in all locations. This brings the fcntl (POSIX) path to parity. The codebase already has properly guarded examples in gateway/status.py (_release_file_lock) — this commit applies the same pattern consistently.
Collaborator
This was referenced May 11, 2026
This was referenced May 24, 2026
Contributor
|
This is an automated hermes-sweeper review. Current Evidence:
The duplicate note in the PR discussion is also consistent with the current state: the exact five-file unlock guard change has landed on main. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
fcntl.flock(fd, LOCK_UN)can raiseOSError(e.g.EBADFon an already-closed fd) infinallyblocks. When this happens:fd.close()is skipped, leaving the file lock held foreverThe
msvcrt(Windows) unlock path was already guarded withtry/except (OSError, IOError)in all locations. Thefcntl(POSIX) path was not.Fix
Wrap all unguarded
fcntl.flock(fd, LOCK_UN)calls infinallyblocks withtry/except OSError: pass.Files changed (5 locations):
tools/memory_tool.py_file_lock()tools/environments/file_sync.py_sync_back()cron/scheduler.py_run_ticks()agent/shell_hooks.py_allowlist_lock()hermes_cli/auth.py_auth_file_lock()Before vs After
flock(LOCK_UN)raisesEBADFfd.close()skipped, lock held foreverfd.close()runs, lock releasedTests
No existing tests cover these code paths (the flock error scenario is hard to trigger in unit tests). The fix is defensive-only — it cannot break existing behavior since
flock(LOCK_UN)only raises when the fd is already invalid, which means the lock is already released.References
The codebase already has properly guarded examples:
gateway/status.py:308—_release_file_lock()wrapsflock(LOCK_UN)intry/except OSErroragent/google_oauth.py:229— wraps intry/except ImportErrorThis PR applies the same pattern consistently across all remaining locations.