modified: app.py

app.py

@@ -300,19 +300,20 @@ def retrieve_command(command_uuid):
     """Retrieve stored command by UUID (JSON response for plugin)"""
     cleanup_expired_commands()
     
+    # Keep lock for entire operation to prevent race conditions
     with storage_lock:
         command_data = command_storage.get(command_uuid)
         
-    if not command_data:
-        return jsonify({'error': 'Command not found or expired'}), 404
+        if not command_data:
+            return jsonify({'error': 'Command not found or expired'}), 404
         
-    # Check if expired
-    if datetime.fromisoformat(command_data['expires_at']) < datetime.now(timezone.utc):
-        with storage_lock:
+        # Check if expired
+        if datetime.fromisoformat(command_data['expires_at']) < datetime.now(timezone.utc):
             del command_storage[command_uuid]
-        return jsonify({'error': 'Command expired'}), 410
+            return jsonify({'error': 'Command expired'}), 410
         
-    return jsonify(command_data), 200
+        # Return a copy to avoid modification outside lock
+        return jsonify(dict(command_data)), 200
 
 # Serve /versions as JSON
 @app.route('/versions')