{"repo":"NousResearch/hermes-agent","public_id":"24623","display_label":"TOCTOU race conditions in lazy-init globals","summary":"Multiple issues and fixes targeting time-of-check-to-time-of-use race conditions in lazy initialization routines, particularly around `_global_allow_private_urls` and `_load_google_modules()`. The concern is that flags are set before their associated values or imports are fully ready, exposing concurrent callers to stale state.","subsystem":"agent","counts":{"members":8,"open_issues":2,"open_issues_distinct":2,"open_prs":1,"closed_issues":0,"merged_prs":0,"attempt_prs":6},"landed_fix":null,"resolution":{"state":"unresolved","by":null},"freshness":{"state":"never_verified","last_verified_at":null,"is_stale":false},"grouping":{"backbone":"STRUCTURAL_PARTIAL","link_density":0.22714285714285715},"fix_edges":[],"members":[{"kind":"issue","number":24623,"title":"[Bug]: _global_allow_private_urls() sets _allow_private_resolved=True before computing the cache value — concurrent callers see stale False","url":null,"state":"open"},{"kind":"issue","number":24673,"title":"concurrency: _load_google_modules() TOCTOU — _google_modules_loaded set before imports complete","url":null,"state":"open"},{"kind":"pr","number":24636,"title":"fix(url_safety): close TOCTOU race in _global_allow_private_urls (#24623)","url":null,"state":"open","close_reason":{"refs":[{"kind":"commit","value":"f85d58da4a2e","number":0}],"category":"uncategorized","implication":"needs_llm"},"merged":false},{"kind":"pr","number":24641,"title":"fix(url_safety): fix TOCTOU race in _global_allow_private_urls lazy-init","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#24636","number":24636},{"kind":"pr","value":"#24623","number":24623}],"category":"duplicate_of","implication":"duplicate"},"merged":false},{"kind":"pr","number":24645,"title":"fix(url_safety): eliminate TOCTOU race in _global_allow_private_urls","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#24641","number":24641}],"category":"superseded_by_pr","implication":"superseded"},"merged":false,"is_fix_pr":true,"fix_tier":"suggested","fix_detail_withheld":true},{"kind":"pr","number":24679,"title":"fix(google_chat): double-checked locking for _load_google_modules() TOCTOU","url":null,"state":"closed","close_reason":{"category":"silent_close","implication":"active"},"merged":false},{"kind":"pr","number":24772,"title":"fix(core): close TOCTOU race windows in lazy module resolvers","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#24671","number":24671},{"kind":"pr","value":"#24669","number":24669},{"kind":"pr","value":"#24692","number":24692},{"kind":"pr","value":"#24687","number":24687},{"kind":"pr","value":"#24694","number":24694},{"kind":"pr","value":"#24679","number":24679},{"kind":"pr","value":"#24673","number":24673}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false,"is_fix_pr":true,"fix_tier":"suggested","fix_detail_withheld":true},{"kind":"pr","number":128340,"title":"fix(google-chat): serialize lazy dependency initialization","url":null,"state":"closed","close_reason":{"category":"uncategorized","implication":"needs_llm"},"merged":false}],"trust":{"default_tier":"verified","includes_suggested":false}}