Cairn
NousResearch/hermes-agent

Thread-safety fixes for transport discovery TOCTOU races

Cluster 24687 · agent. Data as of

2 open items. Fix attempted, not merged.

The short answer

1open issue
1open PR
5items grouped
Known?
Yes. 5 related items grouped here, 0 issues already closed.
Fix event
No fix has been merged to main. 3 PRs closed without merging; see the attempts below.
Tracker
The maintainers' tracker marks this unresolved. That is separate from the fix event.
Still open
1 issue and 1 PR.

These issues and pull requests address concurrency bugs—specifically TOCTOU (time-of-check/time-of-use) race conditions—in transport discovery and lazy module resolution. The work focuses on serializing discovery logic and correcting unsafe flag-setting patterns across agent and transport initialization.

Open issues1

  • Issue#24687concurrency: agent/transports _discovered flag set before imports complete (TOCTOU)

Open PRs1

  • PR#83794fix(transports): serialize transport discovery

3 PRs closed without merging

From the close comments: closed without comment 1 · done elsewhere 1 · partial fix 1

  • #24692 fix(transports): double-checked locking for _discover_transports() TOCTOU · closed without comment
  • #24772 fix(core): close TOCTOU race windows in lazy module resolvers · done elsewhere → #24671, #24669, #24692, #24687, #24694, #24679, #24673
  • #83806 fix(transports): make discovery thread-safe · partial fix → #83794
How this cluster was grouped
  • Link evidence (structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
  • Pairwise link density 0.40: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem
agent
Closed issues
0
Attempts
3 PRs closed without merging

For your agent

The same facts, typed.

cluster/24687.json
cluster/24687.md