From 6d3865130535f8717f443542d611ce6f99881ad4 Mon Sep 17 00:00:00 2001
From: SimolZimol <70102430+SimolZimol@users.noreply.github.com>
Date: Wed, 7 Jan 2026 04:20:42 +0100
Subject: [PATCH] 	modified:   app.py

---
 app.py | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/app.py b/app.py
index f9cea3d..fd92385 100644
--- a/app.py
+++ b/app.py
@@ -300,19 +300,20 @@ def retrieve_command(command_uuid):
     """Retrieve stored command by UUID (JSON response for plugin)"""
     cleanup_expired_commands()
     
+    # Keep lock for entire operation to prevent race conditions
     with storage_lock:
         command_data = command_storage.get(command_uuid)
-    
-    if not command_data:
-        return jsonify({'error': 'Command not found or expired'}), 404
-    
-    # Check if expired
-    if datetime.fromisoformat(command_data['expires_at']) < datetime.now(timezone.utc):
-        with storage_lock:
+        
+        if not command_data:
+            return jsonify({'error': 'Command not found or expired'}), 404
+        
+        # Check if expired
+        if datetime.fromisoformat(command_data['expires_at']) < datetime.now(timezone.utc):
             del command_storage[command_uuid]
-        return jsonify({'error': 'Command expired'}), 410
-    
-    return jsonify(command_data), 200
+            return jsonify({'error': 'Command expired'}), 410
+        
+        # Return a copy to avoid modification outside lock
+        return jsonify(dict(command_data)), 200
 
 # Serve /versions as JSON
 @app.route('/versions')