Get this on every PR automatically. Webhook fires, AI reviews, you approve.
Install on vercel/eve →
// reviewed by pulllight
PullLight found 1 issue
1 high
// convert to your repo
PullLight caught 1 1 high on this PR.
Install on vercel/eve to get this on every PR automatically — 60 seconds.
Findings
1 issue
high
logic
When a concurrent duplicate-name error is caught and the sandbox is fetched via `getNamedVercelSandbox`, `requiresBaseRuntimeSetup` is set to `input.snapshotId === undefined`. This means the concurrently-created sandbox (which was already set up by the first caller) will have `ensureVercelSandboxBaseRuntime` and `applyInitialVercelNetworkPolicy` applied to it a second time by the second caller. The adopted sandbox should be treated as already set up (i.e., `requiresBaseRuntimeSetup: false`), otherwise the base runtime setup runs twice on the same sandbox.
// packages/eve/src/execution/sandbox/bindings/vercel.ts:415