Merge remote-tracking branch 'origin/master' into codex/pr48-repo-hardening-rfcs

packages/tool-bash/README.md

@@ -30,7 +30,7 @@ Result text: stdout, then a `[stderr]` section, then status markers — `[timed
 
 ### Task ownership (cross-session isolation)
 
-The owning agent is recorded per task id at spawn and kept for the lifetime of the loaded plugin instance (it is **not** cleared on completion). `bash_output`/`bash_kill` reject a task owned by a *different* agent with `task <id> belongs to another session` (a task started with no agent — a non-loop caller — has no owner and is open to anyone; a call with no `exec.agent` cannot access an owned task). Task ids are global and predictable, so under multi-session ACP this ownership check is the fence that stops one session's agent from reading or killing another session's background task. (`TODO(tool-bash-owner-hmr)`: an independent HMR reload of this plugin starts a fresh map, so a task spawned before the reload becomes un-owned — acceptable as HMR is dev-only and the session boundary is one user's cooperative editor; a durable fix attaches ownership to the executor/task lifetime.)
+The owning agent is recorded per task id at spawn and kept for the lifetime of the loaded plugin instance (it is **not** cleared on completion). `bash_output`/`bash_kill` reject a task owned by a *different* agent with `task <id> belongs to another session` (a task started with no agent — a non-loop caller — has no owner and is open to anyone; a call with no `exec.agent` cannot access an owned task). Task ids are global and predictable, so under multi-session ACP this ownership check is the fence that stops one session's agent from reading or killing another session's background task. (`XXX(tool-bash-owner-hmr)`: an independent HMR reload of this plugin starts a fresh map, so a task spawned before the reload becomes un-owned — acceptable as HMR is dev-only and the session boundary is one user's cooperative editor; a durable fix attaches ownership to the executor/task lifetime.)
 
 ## UI presentation
 

packages/tool-bash/src/index.ts

@@ -20,7 +20,7 @@
  * ownership check is the fence that stops one session's agent from reading or
  * killing another session's background task.
  *
- * TODO(tool-bash-owner-hmr): the ownership map is per-plugin-instance, so an
+ * XXX(tool-bash-owner-hmr): the ownership map is per-plugin-instance, so an
  * independent HMR reload of `tool-bash` (without reloading `dsh-bash`) starts a
  * fresh map and a task spawned before the reload becomes un-owned (open to any
  * caller). This is acceptable today — HMR is dev-only, the ACP session boundary
@@ -276,7 +276,7 @@ export function apply(ctx: Context): void {
   // another session's background task. A task with no recorded owner (started by
   // a non-loop caller, `exec.agent` absent) is unowned and accessible to anyone.
   // An independent `tool-bash` HMR reload resets this map — see the
-  // TODO(tool-bash-owner-hmr) note in the module doc.
+  // XXX(tool-bash-owner-hmr) note in the module doc.
   const taskOwner = new Map<string, Agent>()
 
   /**

packages/tool-bash/tests/tools.spec.ts

@@ -468,7 +468,7 @@ describe('background task ownership (cross-session isolation)', () => {
   })
 
   it('documents the HMR caveat: an independent tool-bash reload resets ownership', async () => {
-    // The ownership map is per-plugin-instance (TODO(tool-bash-owner-hmr)). When
+    // The ownership map is per-plugin-instance (XXX(tool-bash-owner-hmr)). When
     // ONLY tool-bash is reloaded (bash/executor + task survive), the new instance
     // has an empty map, so the previously-owned task becomes unowned (open). This
     // test pins that documented behavior — a regression here (e.g. an accidental