cleveragents/cleveragents-core

Fork 3

BUG-HUNT: [tool-registry] tool.py creates its own SQLAlchemy engine bypassing DI container #7768

New issue

Open

opened 2026-04-12 03:29:09 +00:00 by HAL9000 · 3 comments

HAL9000 commented

2026-04-12 03:29:09 +00:00

Owner

Bug Report: [Architecture] `tool.py` `_get_tool_registry_service()` Bypasses DI Container — Creates Independent SQLAlchemy Engine

Severity Assessment

Impact: The tool CLI creates its own SQLAlchemy engine and session factory independently of the DI container. This means: (1) any transaction isolation configured by the container is bypassed, (2) the tool registry service is not the same instance as used elsewhere in the application, potentially creating stale-read or lost-update issues, (3) no event bus events are emitted for tool registrations.
Likelihood: Triggered on every agents tool add/remove/list/show invocation
Priority: Medium

Location

File: src/cleveragents/cli/commands/tool.py
Function: _get_tool_registry_service
Lines: 62–84

Description

Every other CLI command module accesses services via the DI container (e.g. get_container().actor_service(), get_container().skill_service()). The tool.py module instead directly constructs its own SQLAlchemy engine, session factory, and repositories:

# tool.py lines 62-84
def _get_tool_registry_service() -> Any:
    from cleveragents.application.container import get_container
    container = get_container()
    database_url: str = container.database_url()  # gets URL only

    from sqlalchemy import create_engine
    from sqlalchemy.orm import sessionmaker
    from cleveragents.application.services.tool_registry_service import ToolRegistryService
    from cleveragents.infrastructure.database.repositories import (
        ToolRegistryRepository,
        ValidationAttachmentRepository,
    )

    engine = create_engine(database_url, echo=False)  # NEW engine every call!
    factory = sessionmaker(bind=engine, expire_on_commit=False)
    tool_repo = ToolRegistryRepository(session_factory=factory)
    attachment_repo = ValidationAttachmentRepository(session_factory=factory)
    return ToolRegistryService(
        tool_repo=tool_repo,
        attachment_repo=attachment_repo,
    )

This is called on every command invocation, so a new engine (and potentially new connection pool) is created each time.

Contrast with validation.py (the sibling command for the same domain) which uses the DI container correctly:

# validation.py
def _get_tool_registry_service() -> Any:
    from cleveragents.application.container import get_container
    return get_container().tool_registry_service()  # CORRECT

Expected Behavior

tool.py should delegate to the DI container like every other module:

def _get_tool_registry_service() -> Any:
    from cleveragents.application.container import get_container
    return get_container().tool_registry_service()

Actual Behavior

New SQLAlchemy engine created on every call
Bypasses container's connection pool, isolation level, and UoW transaction management
No event bus events emitted (container wires the event bus; this bypasses it)
Inconsistency: validation.py in the same directory uses the container correctly

Suggested Fix

def _get_tool_registry_service() -> Any:
    from cleveragents.application.container import get_container
    return get_container().tool_registry_service()

TDD Note

After this bug issue is verified, a corresponding Type/Testing issue will be created for TDD.

Automated by CleverAgents Bot
Supervisor: Bug Hunting | Agent: bug-hunter

## Bug Report: [Architecture] `tool.py` `_get_tool_registry_service()` Bypasses DI Container — Creates Independent SQLAlchemy Engine ### Severity Assessment - **Impact**: The tool CLI creates its own SQLAlchemy engine and session factory independently of the DI container. This means: (1) any transaction isolation configured by the container is bypassed, (2) the tool registry service is not the same instance as used elsewhere in the application, potentially creating stale-read or lost-update issues, (3) no event bus events are emitted for tool registrations. - **Likelihood**: Triggered on every `agents tool add/remove/list/show` invocation - **Priority**: Medium ### Location - **File**: `src/cleveragents/cli/commands/tool.py` - **Function**: `_get_tool_registry_service` - **Lines**: 62–84 ### Description Every other CLI command module accesses services via the DI container (e.g. `get_container().actor_service()`, `get_container().skill_service()`). The `tool.py` module instead directly constructs its own SQLAlchemy engine, session factory, and repositories: ```python # tool.py lines 62-84 def _get_tool_registry_service() -> Any: from cleveragents.application.container import get_container container = get_container() database_url: str = container.database_url() # gets URL only from sqlalchemy import create_engine from sqlalchemy.orm import sessionmaker from cleveragents.application.services.tool_registry_service import ToolRegistryService from cleveragents.infrastructure.database.repositories import ( ToolRegistryRepository, ValidationAttachmentRepository, ) engine = create_engine(database_url, echo=False) # NEW engine every call! factory = sessionmaker(bind=engine, expire_on_commit=False) tool_repo = ToolRegistryRepository(session_factory=factory) attachment_repo = ValidationAttachmentRepository(session_factory=factory) return ToolRegistryService( tool_repo=tool_repo, attachment_repo=attachment_repo, ) ``` This is called on every command invocation, so a new engine (and potentially new connection pool) is created each time. Contrast with `validation.py` (the sibling command for the same domain) which uses the DI container correctly: ```python # validation.py def _get_tool_registry_service() -> Any: from cleveragents.application.container import get_container return get_container().tool_registry_service() # CORRECT ``` ### Expected Behavior `tool.py` should delegate to the DI container like every other module: ```python def _get_tool_registry_service() -> Any: from cleveragents.application.container import get_container return get_container().tool_registry_service() ``` ### Actual Behavior - New SQLAlchemy engine created on every call - Bypasses container's connection pool, isolation level, and UoW transaction management - No event bus events emitted (container wires the event bus; this bypasses it) - Inconsistency: `validation.py` in the same directory uses the container correctly ### Suggested Fix ```python def _get_tool_registry_service() -> Any: from cleveragents.application.container import get_container return get_container().tool_registry_service() ``` ### Category architecture ### TDD Note After this bug issue is verified, a corresponding Type/Testing issue will be created for TDD. --- **Automated by CleverAgents Bot** Supervisor: Bug Hunting | Agent: bug-hunter

HAL9000 added this to the v3.2.0 milestone

2026-04-12 03:45:58 +00:00

HAL9000 referenced this issue

2026-04-12 03:47:56 +00:00

[AUTO-PROJ-OWN] Project Owner Report (Cycle 1) #7724

HAL9000 added the

labels

2026-04-12 05:47:55 +00:00

freemo added the

Type

Bug

label

2026-04-12 18:33:38 +00:00

HAL9000 added

and removed

labels

2026-04-14 05:58:20 +00:00

HAL9000 commented

2026-04-14 05:58:20 +00:00

Author

Owner

✅ Verified — Architecture bug: tool.py bypasses DI container, creating independent SQLAlchemy engine. MoSCoW: Must-have. Priority: High — architecture violation.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

✅ **Verified** — Architecture bug: tool.py bypasses DI container, creating independent SQLAlchemy engine. MoSCoW: Must-have. Priority: High — architecture violation. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner-pool-supervisor

HAL9000 commented

2026-04-14 06:11:37 +00:00

Author

Owner

✅ Verified — Architecture bug: tool.py bypasses DI container, creating independent SQLAlchemy engine. MoSCoW: Must-have. Priority: High — architecture violation.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

HAL9000 commented

2026-04-14 06:15:06 +00:00

Author

Owner

✅ Verified — Architecture bug: tool.py bypasses DI container, creating independent SQLAlchemy engine. MoSCoW: Must-have. Priority: High — architecture violation.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor