Reviewer finding, not yet independently confirmed.
pendingTarget in internal/validation/target.go:188-193 is a package-level variable set during target validation and read and cleared by IsPendingTarget() when formatting the error hint. Two concurrent requests targeting different pending agents can overwrite each other, so one operator may be told to accept the other operator's agent.
Fix: return the pending-target result from validation or carry it per call instead of in a global.
Found in the September 2026 codebase review. Tracked in the review tracking issue.
Reviewer finding, not yet independently confirmed.
pendingTargetininternal/validation/target.go:188-193is a package-level variable set during target validation and read and cleared byIsPendingTarget()when formatting the error hint. Two concurrent requests targeting different pending agents can overwrite each other, so one operator may be told to accept the other operator's agent.Fix: return the pending-target result from validation or carry it per call instead of in a global.
Found in the September 2026 codebase review. Tracked in the review tracking issue.