ImportProfiles (batch) still races under parallel execution — no flock like ImportProfile

[maruiz93]

What happens

Functional tests fail on main with unsupported provider type or profile errors despite PRs #6421 and #6437 fixing the same race in ImportProfile (singular). The batch function ImportProfiles (sandbox.go:508) performs delete+reimport without flock protection.

With parallelism=4 in functional tests, all 4 processes start ImportProfiles simultaneously, see a hash cache miss (no process has written the cache yet), and each deletes and reimports the same profiles. Another process's EnsureProvider hits the gateway during a delete window and gets NotFound.

The local internal/scaffold/fullsend-repo/profiles/ directory contains fullsend-github-ro.yaml and fullsend-vertex-ai.yaml — the same profiles that ImportProfile (singular) imports from the URL-resolved agents repo with proper flock protection. The unfenced batch import in step 2 clobbers step 1's safely-imported profiles.

Latest main (9c4ca5c6): Functional Tests run 32477527362 — all 4 triage cases fail with provider creation errors.

What should happen

ImportProfiles should have the same flock serialization as ImportProfile to prevent parallel processes from racing on profile delete+reimport.

How to reproduce

1. Check out main at 9c4ca5c6 or later (includes both fix(#6420): make ImportProfile concurrency-safe with hash-based caching #6421 and fix(#6435): serialize ImportProfile with flock and retry EnsureProvider #6437).
2. Run make functional-tests or push to a PR — the triage suite runs 4 cases in parallel.
3. All 4 cases fail with unsupported provider type or profile.

Context

Blocks CI on all open PRs that run functional tests. Follow-up to #6420 (closed by #6421) and #6435 (closed by #6437) — same class of race, different code path.

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 12:22 PM UTC · Completed 12:26 PM UTC

Commit: 9c4ca5c · View workflow run →

[fullsend-ai-triage]

Severity: high — this blocks CI on all open PRs running functional tests.

Root cause

Code inspection confirms the diagnosis: ImportProfile (line 176) wraps its delete+reimport in syscall.Flock(LOCK_EX) with a double-check cache pattern, but ImportProfiles (line 508) has no such protection. The hash cache alone is insufficient because all parallel processes see the miss simultaneously.

Related issues

• sandbox: ImportProfile delete-then-reimport is not concurrency-safe #6420 (closed by fix(#6420): make ImportProfile concurrency-safe with hash-based caching #6421) — same race class in ImportProfile, fixed with hash caching
• sandbox: ImportProfile provider race persists after #6421 fix under parallel eval #6435 (closed by fix(#6435): serialize ImportProfile with flock and retry EnsureProvider #6437) — same race persisting after fix(#6420): make ImportProfile concurrency-safe with hash-based caching #6421, fixed with flock + retry
• This is the third instance of the same race pattern, now in the batch code path

Recommended fix

Add flock serialization to ImportProfiles mirroring ImportProfile's pattern: acquire an exclusive file lock (keyed by directory path via profileTempPath), double-check the hash cache after acquisition, then perform delete+reimport inside the critical section.

Proposed test

func TestImportProfiles_ConcurrentSafety(t *testing.T) {
    // Set up a temp dir with valid profile YAMLs and a fake
    // openshell that logs calls and sleeps briefly to widen
    // the race window. Launch 4 goroutines calling ImportProfiles.
    // Assert: delete+import runs exactly once per profile,
    // no goroutine errors, cache file written correctly.
}

---

Labels: This is a concurrency bug in the sandbox component (internal/sandbox/), blocking CI. It follows the same pattern as #6420 and #6435 which were labeled type/bug, priority/high, component/sandbox.

---

Next steps:

• /fs-code — agent creates a PR to implement this issue
• /fs-code <your instruction> — agent implements with your specific guidance

[fullsend-ai-coder]

🤖 Finished Code · ✅ Success · Started 12:28 PM UTC · Completed 12:36 PM UTC

Commit: 9c4ca5c · View workflow run →