Skip to content

fix(core): concurrency cancellation, TOCTOU in callTool, defensive hook copies, and new tests - #6

Open
indrazm wants to merge 1 commit into
mainfrom
fix-core-bugs
Open

fix(core): concurrency cancellation, TOCTOU in callTool, defensive hook copies, and new tests#6
indrazm wants to merge 1 commit into
mainfrom
fix-core-bugs

Conversation

@indrazm

@indrazm indrazm commented Jul 4, 2026

Copy link
Copy Markdown
Owner

Summary here

…ok copies, and new tests

- concurrency.ts: add AbortSignal support and stop sibling workers on error
- tool-execution.ts: accept AbortSignal for early cancellation on stream abort
- prompt-request.ts: create AbortController in stream(), abort in finally; add
  .catch(() => {}) to detached promise chain; defensively copy newMessages at
  all hook call sites to prevent shared-mutable-state corruption
- agent.ts: fix TOCTOU race in callTool() — single get() lookup + callWithTool()
  instead of separate contains() + call() lookups
- tool-set.ts: add callWithTool() for atomic tool invocation with pre-resolved ref
- tool-execution.ts, mcp/tool.ts: Symbol.for() -> Symbol() to avoid cross-realm
  symbol collisions
- test: concurrency.test.ts (10 tests), compact.test.ts (12 tests),
  tool-set.test.ts (+4 TOCTOU tests), prompt-request.test.ts (+2 tests for
  unhandled rejection and message integrity)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant