hermes - 💡(How to fix) Fix [mcp_lazy] MEDIUM: get_pool has unlocked check-then-set race on pool creation

Severity: MEDIUM (concurrency, race)

get_pool has an unlocked check-then-set race on pool creation.

Evidence

plugins/mcp_lazy/pool.py:147-150 — get_pool does check-then-set on _pools (a WeakValueDictionary) with no lock around the get/create/assign. Two threads handling the same new session_id (e.g. agent thread + tool-dispatch thread) can each create a DeferredToolPool; one wins the dict, the loser's promotions are silently lost.

Impact

Under concurrent first-touch for one session, promoted-tool state can be silently lost — tools the model promoted stay stubbed.

Fix

Guard create-and-insert under a module lock with double-checked locking (re-get inside the lock). Add a regression test for concurrent pool creation (existing test_concurrent_promotion.py tests promote, not creation).

Note

If Hermes guarantees single-threaded per-session request handling, severity downgrades to LOW — worth confirming against the dispatch model.

Filed from opus-4.8 plugin audit (mcp_lazy).