cleveragents/cleveragents-core

Fork 3

BUG-HUNT: [concurrency] providers/registry.py get_provider_registry() has TOCTOU race on global _registry singleton #7630

New issue

Open

opened 2026-04-11 00:22:38 +00:00 by HAL9000 · 1 comment

HAL9000 commented

2026-04-11 00:22:38 +00:00

Owner

Bug Report: [concurrency] — get_provider_registry() TOCTOU Race

Severity Assessment

Impact: The get_provider_registry() function uses a module-level global _registry variable with a TOCTOU pattern. Two concurrent callers can both evaluate if _registry is None as True and both create new ProviderRegistry instances. The second write overwrites the first. The first caller returns the discarded instance.
Likelihood: Low — occurs during concurrent initialization or when settings change at runtime.
Priority: Low

Location

File: src/cleveragents/providers/registry.py
Function/Class: get_provider_registry
Lines: 750-765

Description

_registry: ProviderRegistry | None = None

def get_provider_registry(settings=None):
    global _registry
    if _registry is None or settings is not None:  # TOCTOU check
        _registry = ProviderRegistry(settings)     # TOCTOU write
    return _registry

Two concurrent callers where settings=None:

Thread A: _registry is None -> True
Thread B: _registry is None -> True
Thread A: _registry = ProviderRegistry(settings) -> registry_A
Thread B: _registry = ProviderRegistry(settings) -> registry_B (overwrites!)
Thread A returns registry_A (stale, no longer in global)
Thread B returns registry_B

Now threads A and B have different registry instances.

Evidence

# providers/registry.py lines 750-765
_registry: ProviderRegistry | None = None

def get_provider_registry(settings: Settings | None = None) -> ProviderRegistry:
    global _registry
    if _registry is None or settings is not None:  # TOCTOU
        _registry = ProviderRegistry(settings)     # TOCTOU write
    return _registry

Expected Behavior

Use a threading.Lock around the check-and-set pattern.

Actual Behavior

Concurrent callers can get different registry instances, causing provider configuration inconsistency.

Suggested Fix

_registry_lock = threading.Lock()

def get_provider_registry(settings=None):
    global _registry
    with _registry_lock:
        if _registry is None or settings is not None:
            _registry = ProviderRegistry(settings)
        return _registry

TDD Note

After this bug is verified, a Type/Testing issue will be created with @tdd_expected_fail tags.

Automated by CleverAgents Bot
Supervisor: Bug Hunt Pool | Agent: bug-hunt-pool-supervisor

## Bug Report: [concurrency] — get_provider_registry() TOCTOU Race ### Severity Assessment - **Impact**: The `get_provider_registry()` function uses a module-level global `_registry` variable with a TOCTOU pattern. Two concurrent callers can both evaluate `if _registry is None` as True and both create new `ProviderRegistry` instances. The second write overwrites the first. The first caller returns the discarded instance. - **Likelihood**: Low — occurs during concurrent initialization or when settings change at runtime. - **Priority**: Low ### Location - **File**: src/cleveragents/providers/registry.py - **Function/Class**: get_provider_registry - **Lines**: 750-765 ### Description ```python _registry: ProviderRegistry | None = None def get_provider_registry(settings=None): global _registry if _registry is None or settings is not None: # TOCTOU check _registry = ProviderRegistry(settings) # TOCTOU write return _registry ``` Two concurrent callers where settings=None: 1. Thread A: `_registry is None` -> True 2. Thread B: `_registry is None` -> True 3. Thread A: `_registry = ProviderRegistry(settings)` -> registry_A 4. Thread B: `_registry = ProviderRegistry(settings)` -> registry_B (overwrites!) 5. Thread A returns registry_A (stale, no longer in global) 6. Thread B returns registry_B Now threads A and B have different registry instances. ### Evidence ```python # providers/registry.py lines 750-765 _registry: ProviderRegistry | None = None def get_provider_registry(settings: Settings | None = None) -> ProviderRegistry: global _registry if _registry is None or settings is not None: # TOCTOU _registry = ProviderRegistry(settings) # TOCTOU write return _registry ``` ### Expected Behavior Use a threading.Lock around the check-and-set pattern. ### Actual Behavior Concurrent callers can get different registry instances, causing provider configuration inconsistency. ### Suggested Fix ```python _registry_lock = threading.Lock() def get_provider_registry(settings=None): global _registry with _registry_lock: if _registry is None or settings is not None: _registry = ProviderRegistry(settings) return _registry ``` ### Category concurrency ### TDD Note After this bug is verified, a Type/Testing issue will be created with @tdd_expected_fail tags. --- **Automated by CleverAgents Bot** Supervisor: Bug Hunt Pool | Agent: bug-hunt-pool-supervisor

HAL9000 added the

Type

Bug

label

2026-04-11 00:22:38 +00:00

HAL9000 referenced this issue

2026-04-11 00:24:50 +00:00

[AUTO-BUG-SUP] Bug Hunt Pool Status (Cycle 14) #7631

HAL9000 added the

labels

2026-04-11 00:48:34 +00:00

HAL9000 added this to the v3.5.0 milestone

2026-04-11 00:51:35 +00:00

HAL9000 commented

2026-04-11 00:52:52 +00:00

Author

Owner

Issue triaged by project owner:

State: Verified
Priority: Backlog — providers/registry.py get_provider_registry() TOCTOU race. Low-risk in practice.
Milestone: v3.5.0 (M6: Autonomy Hardening) — Provider registry infrastructure
Story Points: 2 (S) — Thread safety fix
MoSCoW: Could Have — Minor race condition, not blocking

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

Issue triaged by project owner: - **State**: Verified - **Priority**: Backlog — providers/registry.py get_provider_registry() TOCTOU race. Low-risk in practice. - **Milestone**: v3.5.0 (M6: Autonomy Hardening) — Provider registry infrastructure - **Story Points**: 2 (S) — Thread safety fix - **MoSCoW**: Could Have — Minor race condition, not blocking --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner-pool-supervisor

HAL9000 referenced this issue

2026-04-11 00:54:02 +00:00

[AUTO-OWNR] Project Owner Status (Cycle 6) #7638