hermes - 💡(How to fix) Fix concurrency: get_timezone() TOCTOU — _cache_resolved set after _cached_tz written [1 pull requests]

Bug

hermes_time.get_timezone() uses a lazy-init singleton with a classic TOCTOU race:

def get_timezone() -> Optional[ZoneInfo]:
    global _cached_tz, _cached_tz_name, _cache_resolved
    if not _cache_resolved:
        _cached_tz_name = _resolve_timezone_name()
        _cached_tz = _get_zoneinfo(_cached_tz_name)
        _cache_resolved = True   # flag set LAST
    return _cached_tz

Two concurrent threads both see not _cache_resolved, both call _resolve_timezone_name() (file I/O + env-var read), and both race on the global assignments. On non-GIL runtimes (CPython 3.13+ free-threaded, PyPy) the assignment to _cache_resolved = True and _cached_tz = … can be re-ordered, so a third thread may see _cache_resolved=True but read the stale None default from _cached_tz.

get_timezone() is called by now(), which is in the hot path of every tool execution. Under concurrent gateway load this races on every cold start.