| #473 |
Race Condition: Vault cache read-modify-write without lock
engine/config.py:227-285
Vault cache operations not protected by lock:
1. Cache read at line 227-24...
|
closed |
high |
2025-12-17 01:42 |
- |
|
| #472 |
Race Condition: StorageService.provider lazy init without lock
engine/services/storage_service.py:67-76
StorageService.provider property uses lazy initialization ...
|
closed |
high |
2025-12-17 01:42 |
- |
|
| #471 |
Performance: Unnecessary list() around dict.keys() in multiple files
Several files wrap dict.keys() in list() unnecessarily for iteration:
1. engine/tools/parallel_join...
|
closed |
low |
2025-12-17 01:11 |
- |
|
| #470 |
Code Quality: Module constant lists should be tuples for immutability
Three module-level constants are defined as lists but never modified. Should be tuples:
1. engine/s...
|
closed |
medium |
2025-12-17 01:11 |
- |
|
| #469 |
Performance: O(N log N) sorted() for cache eviction in activity_worker.py
engine/services/activity_worker.py:120-125 uses sorted() for LRU cache eviction.
sorted() is O(N lo...
|
closed |
low |
2025-12-17 01:11 |
- |
|
| #468 |
Performance: Regex compiled on every call in operators.py and variable_resolver.py
Multiple hot-path functions compile regex patterns on every call instead of once:
1. engine/interpr...
|
closed |
medium |
2025-12-17 01:11 |
- |
|
| #467 |
Race Condition: notification_count increment without lock in activity_worker.py
engine/services/activity_worker.py:252-254 increments notification_count without synchronization.
I...
|
closed |
medium |
2025-12-17 01:11 |
- |
|
| #466 |
Race Condition: _last_cache_check_time modified without lock in http_request.py
engine/tools/http_request.py:209-231 modifies module-level _last_cache_check_time without synchroniz...
|
closed |
medium |
2025-12-17 01:11 |
- |
|
| #465 |
Race Condition: TOCTOU in http_request.py and shell_command.py cache check
Two files have Time-Of-Check-Time-Of-Use (TOCTOU) race conditions in _should_clear_cache():
1. engi...
|
closed |
high |
2025-12-17 01:11 |
- |
|
| #464 |
Memory Leak: Unbounded _secret_managers in secret_manager.py
engine/services/secret_manager.py:287,304-308 has unbounded _secret_managers dict.
Each unique conf...
|
closed |
medium |
2025-12-17 01:11 |
- |
|
| #463 |
Memory Leak: _active_tokens never auto-cleaned in execution_token.py
engine/sandbox/execution_token.py:309,312-328 stores ExecutionToken instances in _active_tokens dict...
|
closed |
high |
2025-12-17 01:11 |
- |
|
| #462 |
Memory Leak: Unbounded _tenant_config_instances in config.py
engine/config.py:584,598-605 has unbounded _tenant_config_instances dict.
Each unique tenant_id cre...
|
closed |
high |
2025-12-17 01:11 |
- |
|
| #461 |
Memory Leak: Unbounded circuit breaker caches in docker/client.py, email_tool.py, llm.py
Multiple files have unbounded module-level circuit breaker caches without TTL or max size limits:
1...
|
closed |
high |
2025-12-17 01:11 |
- |
|
| #460 |
MEDIUM: Performance bottlenecks in hot paths
1. N+1 activity queries (activity_logger.py:519) - HIGH
2. O(N²) variable lookups in loops (inline_e...
|
closed |
medium |
2025-12-17 00:17 |
- |
|
| #459 |
HIGH: Performance - list() to tuple() conversions
Unnecessary list allocations:
1. list(dict.keys())[-1] -> tuple (inline_executor.py:690,893)
2. list...
|
closed |
high |
2025-12-17 00:17 |
- |
|
| #458 |
MEDIUM: TOCTOU race conditions in DB operations
Check-then-act patterns without atomicity:
1. S3 deduplication (storage/s3_provider.py:169-178)
2. W...
|
closed |
medium |
2025-12-17 00:17 |
- |
|
| #457 |
MEDIUM: Determinism violations list unbounded
File: engine/durable_context.py:54
Thread-local violations list grows indefinitely.
100 violations/h...
|
closed |
medium |
2025-12-17 00:17 |
- |
|
| #456 |
HIGH: Activity circuit breaker cache unbounded growth
File: engine/services/activity_worker.py:49
_activity_circuit_breaker_cache dict has no TTL, no max ...
|
closed |
high |
2025-12-17 00:17 |
- |
|
| #455 |
HIGH: 9 singleton race conditions without locking
Multiple singletons in engine/ lack thread-safe initialization:
1. AbsurdClient (absurd_client.py:14...
|
closed |
high |
2025-12-17 00:17 |
- |
|
| #454 |
Fixed flaky durable_cron integration tests
Tests were failing intermittently due to internal queue backlog from parallel test execution.
**Roo...
|
closed |
medium |
2025-12-16 12:09 |
- |
|