cleveragents/cleveragents-core

Fork 3

BUG-HUNT: [concurrency] get_facade() singleton in cli_bootstrap.py is not thread-safe — race condition creates multiple facade instances #7745

New issue

Open

opened 2026-04-12 03:22:37 +00:00 by HAL9000 · 3 comments

HAL9000 commented

2026-04-12 03:22:37 +00:00

Owner

Bug Report: [Concurrency] — Non-Thread-Safe Singleton in get_facade()

Severity Assessment

Impact: Two threads calling get_facade() simultaneously can each construct a separate A2aLocalFacade instance backed by separately-constructed service objects (e.g. two PlanLifecycleService instances with different in-memory state), leading to divergent behavior and lost events/operations
Likelihood: Low-Medium — the CLI is typically single-threaded, but async frameworks, test runners with parallel test workers, or future web server integration can trigger this
Priority: Medium

Location

File: src/cleveragents/a2a/cli_bootstrap.py
Function/Class: get_facade()
Lines: ~49–58

Description

get_facade() implements a lazy singleton using a bare module-level None check without a lock. In multi-threaded execution, two threads can simultaneously observe _facade_instance is None, both call _build_facade(), and the second result silently overwrites the first. If threads have already obtained references to the first facade, they continue using different instances with divergent state.

Evidence

# cli_bootstrap.py
_facade_instance: A2aLocalFacade | None = None

def get_facade() -> A2aLocalFacade:
    global _facade_instance
    if _facade_instance is None:          # <-- Thread A sees None
        _facade_instance = _build_facade()  # Thread B also sees None and builds
    return _facade_instance               # Thread A gets one instance, B gets another
                                          # but module var only stores the last one written

Expected Behavior

Exactly one A2aLocalFacade instance is created per process, regardless of how many threads concurrently call get_facade() during initialization.

Actual Behavior

Under concurrent access during initialization, multiple facade instances can be created. The module-level variable ends up pointing to whichever was assigned last.

Suggested Fix

import threading

_facade_instance: A2aLocalFacade | None = None
_facade_lock = threading.Lock()

def get_facade() -> A2aLocalFacade:
    global _facade_instance
    if _facade_instance is None:
        with _facade_lock:
            if _facade_instance is None:  # double-checked locking
                _facade_instance = _build_facade()
    return _facade_instance

TDD Note

After this bug issue is verified, a corresponding Type/Testing issue will be created for TDD.

Automated by CleverAgents Bot
Supervisor: Bug Hunting | Agent: bug-hunter

## Bug Report: [Concurrency] — Non-Thread-Safe Singleton in get_facade() ### Severity Assessment - **Impact**: Two threads calling `get_facade()` simultaneously can each construct a separate `A2aLocalFacade` instance backed by separately-constructed service objects (e.g. two `PlanLifecycleService` instances with different in-memory state), leading to divergent behavior and lost events/operations - **Likelihood**: Low-Medium — the CLI is typically single-threaded, but async frameworks, test runners with parallel test workers, or future web server integration can trigger this - **Priority**: Medium ### Location - **File**: `src/cleveragents/a2a/cli_bootstrap.py` - **Function/Class**: `get_facade()` - **Lines**: ~49–58 ### Description `get_facade()` implements a lazy singleton using a bare module-level `None` check without a lock. In multi-threaded execution, two threads can simultaneously observe `_facade_instance is None`, both call `_build_facade()`, and the second result silently overwrites the first. If threads have already obtained references to the first facade, they continue using different instances with divergent state. ### Evidence ```python # cli_bootstrap.py _facade_instance: A2aLocalFacade | None = None def get_facade() -> A2aLocalFacade: global _facade_instance if _facade_instance is None: # <-- Thread A sees None _facade_instance = _build_facade() # Thread B also sees None and builds return _facade_instance # Thread A gets one instance, B gets another # but module var only stores the last one written ``` ### Expected Behavior Exactly one `A2aLocalFacade` instance is created per process, regardless of how many threads concurrently call `get_facade()` during initialization. ### Actual Behavior Under concurrent access during initialization, multiple facade instances can be created. The module-level variable ends up pointing to whichever was assigned last. ### Suggested Fix ```python import threading _facade_instance: A2aLocalFacade | None = None _facade_lock = threading.Lock() def get_facade() -> A2aLocalFacade: global _facade_instance if _facade_instance is None: with _facade_lock: if _facade_instance is None: # double-checked locking _facade_instance = _build_facade() return _facade_instance ``` ### Category concurrency ### TDD Note After this bug issue is verified, a corresponding Type/Testing issue will be created for TDD. --- **Automated by CleverAgents Bot** Supervisor: Bug Hunting | Agent: bug-hunter

HAL9000 added this to the v3.2.0 milestone

2026-04-12 03:41:53 +00:00

HAL9000 referenced this issue

2026-04-12 03:47:56 +00:00

[AUTO-PROJ-OWN] Project Owner Report (Cycle 1) #7724

HAL9000 added the

labels

2026-04-12 07:15:56 +00:00

freemo added the

Type

Bug

label

2026-04-12 18:33:47 +00:00

HAL9000 added

and removed

labels

2026-04-14 05:58:36 +00:00

HAL9000 commented

2026-04-14 05:58:36 +00:00

Author

Owner

✅ Verified — Concurrency bug: get_facade() singleton not thread-safe — race condition creates multiple facade instances. MoSCoW: Must-have. Priority: High.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

✅ **Verified** — Concurrency bug: get_facade() singleton not thread-safe — race condition creates multiple facade instances. MoSCoW: Must-have. Priority: High. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner-pool-supervisor

HAL9000 commented

2026-04-14 06:11:53 +00:00

Author

Owner

✅ Verified — Concurrency bug: get_facade() singleton not thread-safe — race condition creates multiple facade instances. MoSCoW: Must-have. Priority: High.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

HAL9000 commented

2026-04-14 06:15:19 +00:00

Author

Owner

✅ Verified — Concurrency bug: get_facade() singleton not thread-safe — race condition creates multiple facade instances. MoSCoW: Must-have. Priority: High.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor