fix(honcho): prevent TOCTOU race in get_honcho_client()#24763
Closed
wesleysimplicio wants to merge 1 commit into
Closed
fix(honcho): prevent TOCTOU race in get_honcho_client()#24763wesleysimplicio wants to merge 1 commit into
wesleysimplicio wants to merge 1 commit into
Conversation
Add import threading, _honcho_client_lock = threading.Lock(), and apply double-checked locking so concurrent callers cannot each construct a separate Honcho instance and silently leak the first connection. The full initialization path (config resolution, lazy SDK install, Honcho(**kwargs)) now runs under the lock after the inner re-check. Closes NousResearch#24759 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Contributor
Author
|
Revisão local concluída. Validei em worktree isolada com:
Resultado: 90 passed. Veredito: o fix de TOCTOU está correto, bem escopado e com cobertura de regressão suficiente para a área alterada. Não encontrei bloqueadores técnicos nesta PR. |
Contributor
|
This appears to be implemented on current Automated hermes-sweeper review evidence:
Thanks for the original focused PR and validation notes; the same bug class is now fixed on main. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
get_honcho_client()inplugins/memory/honcho/client.pyused an unguarded check-then-initialize pattern: two concurrent callers could both pass theis not Noneguard, both run config resolution + lazy SDK install +Honcho(**kwargs)construction, and the second would overwrite the first — leaking an open connection. - Addedimport threadingand_honcho_client_lock = threading.Lock(). Applied double-checked locking: fast lock-free early return when already set, then full initialization (including the expensive config/import path) runs under the lock with a re-check at the top. - AddedTestGetHonchoClientToctouRace(2 tests): 50-thread barrier verifying all concurrent callers…Root cause
The detailed rationale from the original PR body is preserved below. This template update keeps the review structure consistent with #29640.
Fix
Why this shape
This shape mirrors #29640 so reviewers can quickly compare scope, root cause, fix, tests, and related context without having to decode a custom PR description.
Tests
Original body
Related PRs / issues
Closes #24759
Original body
Summary
get_honcho_client()inplugins/memory/honcho/client.pyused an unguarded check-then-initialize pattern: two concurrent callers could both pass theis not Noneguard, both run config resolution + lazy SDK install +Honcho(**kwargs)construction, and the second would overwrite the first — leaking an open connection. - Addedimport threadingand_honcho_client_lock = threading.Lock(). Applied double-checked locking: fast lock-free early return when already set, then full initialization (including the expensive config/import path) runs under the lock with a re-check at the top. - AddedTestGetHonchoClientToctouRace(2 tests): 50-thread barrier verifying all concurrent callers receive the same instance, and a spyHonchoclass confirming the constructor fires exactly once.What Changed
Fluxo
A mudança continua seguindo o fluxo original descrito na seção preservada abaixo, sem ampliar o escopo funcional deste PR.
Visão
A padronização melhora a revisão, reduz ruído e evita deriva de formatação entre PRs abertos.
Test Plan
Original body
What does this PR do?
Summary
get_honcho_client()inplugins/memory/honcho/client.pyused an unguarded check-then-initialize pattern: two concurrent callers could both pass theis not Noneguard, both run config resolution + lazy SDK install +Honcho(**kwargs)construction, and the second would overwrite the first — leaking an open connection.import threadingand_honcho_client_lock = threading.Lock(). Applied double-checked locking: fast lock-free early return when already set, then full initialization (including the expensive config/import path) runs under the lock with a re-check at the top.TestGetHonchoClientToctouRace(2 tests): 50-thread barrier verifying all concurrent callers receive the same instance, and a spyHonchoclass confirming the constructor fires exactly once.Closes #24759
Test plan
uv run python -m pytest tests/test_honcho_client_config.py::TestGetHonchoClientToctouRace -v— 2 passedtest_honcho_client_config.pysuite unaffected🤖 Generated with Claude Code
Solution Sketch
Related Issue
Closes #24759
Type of Change
Changes Made
.github/PULL_REQUEST_TEMPLATE.mdHow to Test
Checklist
Code
fix(scope):,feat(scope):, etc.)pytest tests/ -qand all tests passDocumentation & Housekeeping
docs/, docstrings) — or N/Acli-config.yaml.exampleif I added/changed config keys — or N/ACONTRIBUTING.mdorAGENTS.mdif I changed architecture or workflows — or N/AScreenshots / Logs
Generated by Hermes Turbo
Generated by Hermes Turbo