[mikeland73]

Implements Tier 3 item 13 of specs/perf-improvements.md.

What

• lock.File.Resolve is concurrency-safe. A sync.Mutex guards Packages and its entries, but is only held to read and write the entry. The search API / nix flake prefetch request runs outside the lock. Concurrent resolutions of the same key share one request via singleflight, so e.g. many legacy packages calling Stdenv() at once only resolve nixpkgs once. Get, Remove, Save, Tidy, UpdateStdenv, SetOutputsForPackage, HasAllowInsecurePackages and isDirty take the lock too.
• FillNarInfoCache resolves in parallel. Binary cache eligibility (which calls resolve() for packages missing from the lockfile) now runs in an errgroup with a limit of 8, preserving input order. This is on the ensureStateIsUpToDate path, so devbox add a b c resolves new packages concurrently.
• Race fix in featureflag.Enabled: it wrote to a plain map to log env var overrides once; now a sync.Map. Found by -race in the new tests.
• multi sync passes *lock.File to cuecfg.WriteFile (vet copylocks, since File now has a mutex).

Code that indexes lockfile.Packages directly (e.g. update.go, plugin.go) is unchanged; it runs serially and is documented as not safe to mix with concurrent File method calls.

Tests

• TestResolveConcurrent: 5 packages × 4 callers. A fake search server blocks until all 5 requests are in flight at once (fails if Resolve holds the lock during the request), checks one request per package, and that every caller gets the stored entry.
• TestResolveConcurrentError: failures reach all callers, aren't stored, and are retried.
• TestEligibleForBinaryCacheResolvesConcurrently: same barrier approach for FillNarInfoCache's eligibility checks; verified it fails with SetLimit(1).
• go test -race ./internal/devpkg/... ./internal/lock/... ./internal/boxcli/... passes.

🤖 Generated with Claude Code

[claude]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge.

Summary

The PR resolves missing lockfile entries in parallel, shares requests for the same package, and makes feature-flag logging safe across goroutines.

• Devbox checks package eligibility for the binary cache in parallel.
• Lockfile lookups can run together without duplicating the same request.
• Feature-flag overrides are logged once even when callers run together.
• The performance plan and vendor hash reflect this change.

_{Reviews (2) · Last reviewed commit: "fix: update vendor-hash; release blocked..." · Reviewed by Greptile}

[mikeland73]

@greptileai please re-review. The hang you flagged in TestResolveConcurrent is fixed in 1f9acb2 (blocked handlers are released in cleanup before the server closes), and the vendor-hash is updated. If there are no remaining issues, please approve.

---

_{Written by Claude on behalf of / prompted by @mikeland73.}