Merge remote-tracking branch 'origin/master' into codex/agent-session-jsonl-location

# Conflicts:
#	docs/module-graph.md
#	docs/rfc/INDEX.md
#	packages/core/agent-core/tests/agent-core.spec.ts
#	pnpm-lock.yaml

packages/bash/tool-bash/tests/bash-env.spec.ts

@@ -11,6 +11,7 @@ afterEach(() => vi.unstubAllEnvs())
 
 function execution(sessionId?: string): ToolExecution {
   return {
+    token: Symbol('bash-env-test') as ToolExecution['token'],
     callId: CallId('bash-env-call'),
     name: 'bash',
     arguments: { command: 'true' },

packages/bash/tool-bash/tests/integration.spec.ts

@@ -92,7 +92,7 @@ describe('bash tool through the agent loop', () => {
       textResponse('Session environment inspected.'),
     ])
     const ctx = await harness(adapter, root, dshHome)
-    const handle = ctx.agents.create({
+    const handle = await ctx.agents.create({
       agentId: AgentId('session-env'),
       sessionId: SessionId('session-env-id'),
       agentOptions: { model: 'mock' },
@@ -163,37 +163,30 @@ describe('bash tool through the agent loop', () => {
   it('background: start → poll → completion notice lands as context/message', async () => {
     const adapter = new MockAdapter([
       toolCallResponse('call-1', 'bash', { command: 'echo bg-ok', description: 'test command', run_in_background: true }),
-      toolCallResponse('call-2', 'bash_output', {}, undefined),
+      // Each harness owns a fresh BashLocal service, whose first task id is
+      // deterministically bash-1. Keep the scripted call faithful to what the
+      // model sent; tool arguments are immutable once execution policy begins.
+      toolCallResponse('call-2', 'bash_output', { task_id: 'bash-1' }, undefined),
       textResponse('Background task finished.'),
     ])
-    // The second tool call needs the REAL task id from the first result;
-    // a tools/pre-execute listener rewrites the scripted arguments. (This uses
-    // the low-level capability to mutate `exec` before dispatch — the
-    // unadvertised mechanism behind a future first-class input-rewrite decision;
-    // here it is a test shim to thread the generated id, not a product feature.)
     let taskId = ''
 
     const ctx = await harness(adapter)
     const agent = ctx.agentLoop.create(AgentId('it-bg'), { model: 'mock' })
 
-    // Intercept the first tool result to capture the generated task id, then
-    // rewrite the second scripted call's arguments to use it.
+    // Capture the generated id so the deterministic fixture is checked against
+    // the real executor instead of silently assuming it.
     ctx.on('session/event', (_session, event) => {
       if (event.type === 'tool/result' && taskId === '') {
         const match = /task (bash-\d+)/.exec(resultText(event))
         if (match) taskId = match[1]!
       }
     })
-    ctx.on('tools/pre-execute', async (exec, next) => {
-      if (exec.name === 'bash_output') {
-        exec.arguments = { task_id: taskId }
-      }
-      return next()
-    })
-
     agent.send([{ type: 'text', text: 'run echo bg-ok in the background' }])
     await waitForIdle(ctx, agent)
 
+    expect(taskId).toBe('bash-1')
+
     // Wait for the background task itself (completion may race turn end).
     const task = ctx.bash.get(BashTaskId(taskId))
     if (!task) throw new Error(`task ${taskId} not registered`)

packages/bash/tool-bash/tests/tools.spec.ts

@@ -56,7 +56,7 @@ async function setup() {
  * The registration disposer is tracked so {@link unregisterFakeAgents} can drop
  * it (simulating the owning session disconnecting before a task completes).
  */
-const fakeAgentDisposers = new Map<Context, (() => void)[]>()
+const fakeAgentDisposers = new Map<Context, (() => Promise<void> | void)[]>()
 function registerFakeAgent(ctx: Context, sessionId: string, inject: (...args: unknown[]) => void): Agent {
   // The registry KEY (agent.id) is deliberately DIFFERENT from the session
   // token (session.header.id) — a config agent has `agentId !== sessionId`. The
@@ -74,7 +74,7 @@ function registerFakeAgent(ctx: Context, sessionId: string, inject: (...args: un
 
 /** Unregister every fake agent in this ctx (simulate the owning session disconnecting). */
 function unregisterFakeAgents(ctx: Context): void {
-  for (const dispose of fakeAgentDisposers.get(ctx) ?? []) dispose()
+  for (const dispose of fakeAgentDisposers.get(ctx) ?? []) void dispose()
   fakeAgentDisposers.delete(ctx)
 }
 
@@ -264,7 +264,6 @@ describe('bash tool', () => {
     [{ command: '  ', description: 'd' }, /invalid command/],
     [{ command: 'x', description: '   ' }, /invalid description/],
     [{ command: 'x', description: 'd', timeoutMs: -1 }, /invalid timeoutMs/],
-    [{ command: 'x', description: 'd', timeoutMs: Number.NaN }, /invalid timeoutMs/],
   ])('rejects value-invalid args %j', async (args, pattern) => {
     const ctx = await setup()
     const result = await call(ctx, 'bash', args)
@@ -272,6 +271,15 @@ describe('bash tool', () => {
     expect(text(result)).toMatch(pattern)
   })
 
+  it('rejects a non-JSON numeric argument before tool-specific validation', async () => {
+    const ctx = await setup()
+    const result = await call(ctx, 'bash', {
+      command: 'x', description: 'd', timeoutMs: Number.NaN,
+    })
+    expect(result.isError).toBe(true)
+    expect(text(result)).toContain('tool execution arguments must be losslessly JSON-serializable')
+  })
+
   it('registers all three schemas in the system prompt assembly', async () => {
     const ctx = await setup()
     const names = ctx.tools.schemas().map(schema => schema.name)