src/scope/server/app.py (1)

2203-2227: ⚠️ Potential issue | 🟠 Major

Serialize the cold-cache fill for /api/v1/plugins.

The early None check happens before await plugin_manager.list_plugins_async(), so concurrent first requests can all miss and each run the expensive plugin scan/update checks. Guard the miss path with an asyncio.Lock or memoized task.

🔒 Suggested fix

+_plugins_list_cache_lock = asyncio.Lock()
+
 `@app.get`("/api/v1/plugins")
 `@cloud_proxy`()
 async def list_plugins(
@@
     global _plugins_list_cache
     if _plugins_list_cache is not None:
         return _plugins_list_cache
-
-    try:
-        plugin_manager = get_plugin_manager()
-        plugins_data = await plugin_manager.list_plugins_async()
+    async with _plugins_list_cache_lock:
+        if _plugins_list_cache is not None:
+            return _plugins_list_cache
+        try:
+            plugin_manager = get_plugin_manager()
+            plugins_data = await plugin_manager.list_plugins_async()
 
-        plugins = [_convert_plugin_dict_to_info(p) for p in plugins_data]
+            plugins = [_convert_plugin_dict_to_info(p) for p in plugins_data]
 
-        failed = [
-            FailedPluginInfoSchema(
-                package_name=f.package_name,
-                entry_point_name=f.entry_point_name,
-                error_type=f.error_type,
-                error_message=f.error_message,
+            failed = [
+                FailedPluginInfoSchema(
+                    package_name=f.package_name,
+                    entry_point_name=f.entry_point_name,
+                    error_type=f.error_type,
+                    error_message=f.error_message,
+                )
+                for f in plugin_manager.get_failed_plugins()
+            ]
+
+            response = PluginListResponse(
+                plugins=plugins, total=len(plugins), failed_plugins=failed
             )
-            for f in plugin_manager.get_failed_plugins()
-        ]
-
-        response = PluginListResponse(
-            plugins=plugins, total=len(plugins), failed_plugins=failed
-        )
-        _plugins_list_cache = response
-        return response
-    except Exception as e:
-        logger.error(f"Error listing plugins: {e}")
-        raise HTTPException(status_code=500, detail=str(e)) from e
+            _plugins_list_cache = response
+            return response
+        except Exception as e:
+            logger.error(f"Error listing plugins: {e}")
+            raise HTTPException(status_code=500, detail=str(e)) from e

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/scope/server/app.py` around lines 2203 - 2227, The code checks
_plugins_list_cache before awaiting plugin_manager.list_plugins_async, so
concurrent cold requests cause multiple expensive scans; fix by serializing the
cold-cache fill using an asyncio.Lock (e.g., a module-level _plugins_list_lock)
or by memoizing the in-progress task: acquire the lock (or check/create the
shared task) before calling get_plugin_manager() /
plugin_manager.list_plugins_async(), re-check _plugins_list_cache after
acquiring to avoid race, populate _plugins_list_cache with the created
PluginListResponse (plugins, total, failed_plugins) and release the lock (or let
the awaited task set the cache) so only one scan runs for concurrent first
requests while others await the result.