modified: app.py

app.py

@@ -300,6 +300,7 @@ def retrieve_command(command_uuid):
     """Retrieve stored command by UUID (JSON response for plugin)"""
     cleanup_expired_commands()
     
+    # Keep lock for entire operation to prevent race conditions
     with storage_lock:
         command_data = command_storage.get(command_uuid)
         
@@ -308,11 +309,11 @@ def retrieve_command(command_uuid):
         
         # Check if expired
         if datetime.fromisoformat(command_data['expires_at']) < datetime.now(timezone.utc):
-        with storage_lock:
             del command_storage[command_uuid]
             return jsonify({'error': 'Command expired'}), 410
         
-    return jsonify(command_data), 200
+        # Return a copy to avoid modification outside lock
+        return jsonify(dict(command_data)), 200
 
 # Serve /versions as JSON
 @app.route('/versions')