From 6a2018545b53b5252360aa38fbe4bfda0067fa56 Mon Sep 17 00:00:00 2001 From: Ollie Agent Date: Tue, 18 Aug 2026 07:03:02 +0200 Subject: [PATCH] Mark bypass queue finding resolved --- doc/concurrency-resource-audit.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/doc/concurrency-resource-audit.md b/doc/concurrency-resource-audit.md index c2cc6b6..916310d 100644 --- a/doc/concurrency-resource-audit.md +++ b/doc/concurrency-resource-audit.md @@ -174,7 +174,11 @@ Process GC removes exited processes only after output has been read. An abandone **Remediation:** add an absolute retention TTL independent of `LastRead`, plus output-size limits. -## Medium and lower findings +The following medium finding was verified fixed in commit `1284a83`: + +- **M8. Bypass queue retains cancelled requests** — cancellation now removes the request from the active set, and `NextPending` discards stale queue entries. + +The remaining medium and lower findings are listed below. ### M1. Workflow and prompt goroutines are unbounded @@ -246,13 +250,9 @@ A wildcard event subscription is created with `context.Background()`. Rebuilding ### M8. Bypass queue retains cancelled requests -**Evidence:** `cmd/toolsrv/internal/bypass/bypass.go:59-85`. +**Status:** Fixed in `1284a83`. -Cancellation deletes the request from the map but leaves it in the pending channel. - -**Impact:** cancelled requests consume queue slots and can block valid bypass requests. - -**Remediation:** make cancellation observable to the pending consumer and discard cancelled entries before presenting them for approval. +Cancellation removes the request from the active set. `NextPending` discards stale cancelled entries before presenting requests for approval. ### M9. Concurrent bypass resolution can panic