fix(core): enforce agent-scoped ownership boundaries

packages/fs/tool-fs/tests/fs-tools.e2e.ts

@@ -64,7 +64,7 @@ describe.skipIf(!process.env.DEEPSEEK_API_KEY)('fs tools with-key smoke', () =>
     const sessionDir = await mkdtemp(join(tmpdir(), 'dsh-fs-e2e-session-'))
     try {
       ctx = await fsHarness(configDir, SYSTEM)
-      const handle = ctx.agents.create({
+      const handle = await ctx.agents.create({
         agentId: AgentId('fs-e2e-cwd'),
         sessionId: SessionId(`fs-e2e-cwd-${Date.now()}`),
         meta: { cwd: sessionDir },

packages/fs/tool-fs/tests/tools.spec.ts

@@ -164,11 +164,10 @@ describe('read tool', () => {
     expect(text(result)).toContain('offset must be a positive integer')
   })
 
-  it('rejects a fractional or NaN offset, and a zero/negative limit', async () => {
+  it('rejects a fractional offset and a zero/negative limit', async () => {
     const { ctx } = await setup()
     for (const args of [
       { file_path: 'a.txt', offset: 1.5 },
-      { file_path: 'a.txt', offset: Number.NaN },
       { file_path: 'a.txt', limit: 0 },
       { file_path: 'a.txt', limit: -3 },
     ]) {
@@ -178,6 +177,13 @@ describe('read tool', () => {
     }
   })
 
+  it('rejects a non-JSON numeric offset before tool-specific validation', async () => {
+    const { ctx } = await setup()
+    const result = await call(ctx, 'read', { file_path: 'a.txt', offset: Number.NaN })
+    expect(result.isError).toBe(true)
+    expect(text(result)).toContain('tool execution arguments must be losslessly JSON-serializable')
+  })
+
   it('rejects a limit above the cap', async () => {
     const { ctx } = await setup()
     const result = await call(ctx, 'read', { file_path: 'a.txt', limit: 99999 })