hermes-bsd/plugins
Teknium 47d5177a7d
fix(plugins): thread-safe lazy-singleton helpers; fix honcho TOCTOU (#24759) (#42150)
* fix(plugins): add thread-safe lazy-singleton helpers, fix honcho TOCTOU (#24759)

get_honcho_client() and fal's _load_fal_client() used unlocked
check-then-init: racing threads both ran the expensive build and the
loser's client (open connection) leaked.

Rather than one-off locks, add plugins/plugin_utils.py with two
reusable primitives every plugin author can drop in:
- lazy_singleton: decorator for zero-arg accessors
- SingletonSlot: manual slot for config-keyed accessors (first wins)

Both use double-checked locking; factory runs at most once; failed
builds aren't cached. honcho is the reference consumer; fal's sibling
TOCTOU gets a matching double-checked lock. Plugin dev guide documents
the pattern so future plugins don't reintroduce the race.

Closes #24759

* test(honcho): update reset test for SingletonSlot internals

test_reset_clears_singleton poked the removed _honcho_client module
global directly. Assert through the slot's public peek() surface
instead, matching the #24759 refactor.
2026-06-08 09:35:22 -07:00
..
browser fix: guard int(os.getenv()) casts against malformed env vars (#40598) 2026-06-07 06:14:24 -07:00
context_engine
dashboard_auth fix(desktop): gate OAuth remote connect on AT-or-RT, not access token alone 2026-06-04 22:18:46 -07:00
disk-cleanup fix(cron): re-validate stale cron-output entries before deletion (#37721) 2026-06-04 07:52:04 -07:00
google_meet fix: reap zombie subprocesses in web_server action status and meet_bot cleanup 2026-06-07 21:50:57 -07:00
hermes-achievements fix(dashboard): sanction plugin WS/upload auth via SDK helpers (gated mode) 2026-06-03 16:59:36 -07:00
image_gen fix(image_gen): use gpt-5.5 for Codex image host 2026-06-06 19:31:51 -07:00
kanban docs(kanban): clarify orchestrator profile role in dashboard panel 2026-06-06 19:29:00 -07:00
memory fix(plugins): thread-safe lazy-singleton helpers; fix honcho TOCTOU (#24759) (#42150) 2026-06-08 09:35:22 -07:00
model-providers fix(vision): proactive downgrade for providers rejecting list-type tool content (#41072) 2026-06-07 21:50:57 -07:00
observability feat(middleware): add adaptive execution intercepts 2026-06-03 11:22:06 -07:00
platforms feat(gateway): render terminal tool calls as native bash code blocks on markdown platforms (#41215) 2026-06-07 17:29:55 -07:00
security-guidance
spotify
teams_pipeline
video_gen fix(plugins): thread-safe lazy-singleton helpers; fix honcho TOCTOU (#24759) (#42150) 2026-06-08 09:35:22 -07:00
web fix(web): honor Hermes config-aware SEARXNG_URL lookup 2026-06-08 01:11:08 +05:30
__init__.py
plugin_utils.py fix(plugins): thread-safe lazy-singleton helpers; fix honcho TOCTOU (#24759) (#42150) 2026-06-08 09:35:22 -07:00