Files
cleveragents-core/robot
HAL9000 9a3ad6da66 fix(audit): protect AuditService._ensure_session() with threading.Lock
Rebased onto current master and re-applied the threading.Lock fix to the
updated version of _ensure_session() introduced by the async write-behind
refactor (#1279). The fix is now more critical because the background
audit-writer thread calls _ensure_session() via _write_payload(), making
the TOCTOU race actively exploitable rather than theoretical.

Changes:
- Added self._session_lock = threading.Lock() to __init__()
- Wrapped _ensure_session() session creation with double-checked locking
- Updated step file to use audit_async=False to avoid background thread
  interference with the race test
- Resolved import conflict (kept both import queue and import threading)

ISSUES CLOSED: #991
2026-04-29 21:26:34 +00:00
..